Paul Kunert reports:
Bayswater Medical Centre (BMC) in London is licking its wounds after taking a not insignificant punch to the wallet for discarding highly sensitive medical information in an empty building for a year and a half.
The Information Commissioner’s Office (ICO) said today the data included medical records, prescriptions and patient identifiable medicine. It was left unsecured when BMC vacated its surgery but used the premises as a storage dump from July 2015.
Read more on The Register.
From the Information Commissioner’s Office:
Bayswater Medical Centre (BMC) in London has been fined £35,000 by the Information Commissioner’s Office (ICO) after it left highly sensitive medical information in an empty building.
The personal data, which included medical records, prescriptions and patient-identifiable medicine, was left unsecured in the building for more than 18 months.
In July 2015, BMC moved out of a former GP surgery but continued to use the premises for storage purposes.
In 2016, representatives of another GP surgery were allowed to visit the vacant building with a view to taking over the lease.
Once inside, they found unsecured medical records and other sensitive information and informed BMC, but the owners took no action to secure the data, despite repeated warnings by both the other surgery and the local Clinical Commissioning Group.
In February 2017, officers from NHS England visited the site and found a large quantity of highly sensitive information left on desks, in unlocked cabinets and in bins. They ordered BMC to remove the information the next day.
Steve Eckersley, the ICO’s Head of Enforcement, said
“Bayswater Medical Centre left their patients’ most sensitive data abandoned and with no thought for the distress that this could cause them if it had been lost or misused.”
The ICO ruled that:
- BMC failed to secure the premises or the data stored there, and allowed unsupervised access to the premises by others, who were not authorised to view the data;
- BMC should have known that that exposing this highly sensitive personal information – and potentially losing it -would have caused substantial damage and distress; and
- The contravention was heightened by BMC’s failure to take prompt action to protect patient data for such a long time.
The ICO found that the severity of the breach merited a fine of £80,000, but this was reduced to £35,000 after BMC’s ability to pay was taken into account.
Mr Eckersley said:
“It is our duty to stand up for people’s data rights and to ensure that their sensitive personal information is protected.
“Out of sight is definitely not out of mind. We don’t want anyone to think that they can avoid the law or their duties by abandoning personal data in empty buildings.”