The Information Commissioner’s Office (ICO) has found Betsi Cadwaladr University Health Board in breach of the Data Protection Act after sensitive information was sent to the wrong address.
The information was disclosed when eight letters about patients were sent to one of the people affected in July 2013. The letters should have been sent to a GP’s surgery. Six of the letters included sensitive medical information relating to the patients’ treatment.
An ICO investigation found that the employee responsible for the mistake hadn’t received any form of data protection training. While the health board had introduced mandatory data protection training for all staff in April 2013, by February 2014 only 6.5% of staff had received it. The health board informed the ICO that it did not anticipate providing the training to all of their staff until April 2015.
ICO Assistant Commissioner for Wales, Anne Jones, said:
“We accept mistakes can happen, but organisations must make sure employees handling sensitive personal information are given the necessary training to carry out their role. Betsi Cadwaladr University Health Board failed to do this.
“The health board has now signed an undertaking committing the organisation to improving the training provided to its employees. This includes prioritising staff who manage sensitive information as part of their core role, or who work in a lead information governance role within the organisation by ensuring they’ve received data protection training by 30 September 2014. The health board will also make sure their staff complete refresher training every two years.
“These improvements will significantly reduce the risks of a future breach occurring and help to keep patients’ information secure.”
SOURCE: Information Commissioner’s Office
BBC provides media coverage of the incident.