Admin_Adham
Jump to Key Points DUBLIN, Sept 2 (Reuters) - Ireland's health service operator was fined a record amount for an Irish public body by the country's data regulator for storing medical records in "profound disarray" in areas including a turf shed and a disused bathroom that in some cases were contaminated by animal droppings.
The Data Protection Commission imposed the €645,000 fine on Wednesday after inspecting 12 storage sites to determine if personal data breaches at two former disused and "mould contaminated" psychiatric hospitals where medical records were being stored were systemic issues.
It identified data security failings concerning the physical conditions of storage facilities and integrity of documents held at the sites by the Health Service Executive (HSE), which runs Ireland's public health and social care service.
"The DPC discovered storage areas in such profound disarray and neglect that the records contained within them could not be deemed to be filed in any organised or accessible manner," DPC Deputy Commissioner Graham Doyle said in a statement.
- DPC fined HSE record €645,000 for paper-record storage failures.
- Records stored in disused bathrooms, turf shed, shipping container, derelict rooms.
- Sites had mould, rubble, animal droppings; some records effectively destroyed.
- Unsecured retention beyond retention period ↑ risk of unauthorized access.
- HSE ordered to audit all storage, remove records from unfit units, improve paper-record system.
"There were records stored in disused bathrooms and cubicles, a shipping container in a turf shed, rooms without functioning lighting or heating, as well as derelict buildings at a number of disparate locations."
The unsecure retention of records beyond the period they should be kept risked the unauthorised access to sensitive medical information, Doyle said. Some of the records were "effectively destroyed" by mould, covered in rubble or rotting.
The data watchdog ordered the HSE to carry out a complete audit of all storage facilities, remove records from any unit not fit for purpose and implement an appropriately designed management system for all paper records.
The HSE, which was also fined €65,000 by the DPC in 2020 for similar failures, said it accepted the findings and will comply with all the recommendations.
"We are sorry this has happened and we apologise to patients and the people who use our services," it said in a statement.
(Reporting by Padraic Halpin; Editing by Kirsten Donovan)
