The Aneurin Bevan Health Board (ABHB) has been served a monetary penalty by the Information Commissioner's Office (ICO).
The Welsh health board has been issued with a penalty of £70,000 after a sensitive report was sent to the wrong person. According to the ICO's undertaking, the error occurred when a letter containing a detailed psychological report of a mental-health patient had been sent to another former patient with a similar name.
A consultant emailed his letter to a secretary for formatting, but did not include sufficiently clear identifiers for the secretary to select the correct patient. The doctor had also used the spellings of both patients' names in his email.
Further investigations revealed that neither the consultant nor the secretary had received any data protection training from the data controller, and that practices such as those that led to this incident were widely followed by clinical and secretarial staff within the organisation.
ABHB has signed an undertaking to address the concerns expressed by the ICO during its investigation. This includes ensuring all staff are made aware of, and trained on, the organisation's policies on storage and use of personal data, that there is appropriate and regular monitoring of compliance with policies on data protection and IT security, and that new checking processes are introduced across all sites to confirm a patient's identity before personal information is sent out.
Stephen Eckersley, the ICO's head of enforcement, said: “The health service holds some of the most sensitive information available. The damage and distress caused by the loss of a patient's medical record is obvious, therefore it is vital that organisations across this sector make sure their data protection practices are adequate.
“Aneurin Bevan Health Board failed to have suitable checks in place to keep the sensitive information they handled secure. This case could have been extremely distressing to the individual and their family and may have been prevented if the information had been checked prior to it being sent.
“We are pleased that the board has now committed to taking action to address the problems highlighted by our investigation; however, organisations across the health service must stand up and take notice of this decision if they want to avoid future enforcement action from the ICO.”