Irish health service operator fined for storing data in disused bathroom, turf shed

DUBLIN, Sept 2 (Reuters) – Ireland’s health service operator was fined a record amount for an Irish public body by the country’s data regulator for storing medical records in “profound ​disarray” in areas including a turf shed and a disused ‌bathroom that in some cases were contaminated by animal droppings.

The Data Protection Commission imposed the €645,000 fine on Wednesday after inspecting 12 storage sites to determine if personal data breaches at two former disused and “mould contaminated” psychiatric hospitals ‌where ​medical records were being stored were systemic ⁠issues.

It identified data security failings ⁠concerning the physical conditions of storage facilities and integrity of documents held at the sites by the Health Service Executive (HSE), which runs Ireland’s public health and social care service.

“The DPC ​discovered storage areas in such profound disarray and neglect that the records contained within them could not be deemed to be ⁠filed in any organised or accessible ⁠manner,” DPC Deputy Commissioner Graham Doyle said in a ​statement.

“There were records stored in disused bathrooms and cubicles, a shipping ​container in a turf shed, rooms without functioning lighting ‌or heating, as well as derelict buildings at a number of disparate locations.”

The unsecure retention of records beyond the period they should be kept risked the unauthorised access to sensitive medical information, Doyle said. ⁠Some of the records were “effectively destroyed” by mould, covered in rubble or rotting.

The data watchdog ordered the HSE to carry out a complete audit ⁠of all storage ‌facilities, remove records from any unit not fit ⁠for purpose and implement an appropriately designed management ​system ‌for all paper records.

The HSE, which was also ​fined €65,000 by ⁠the DPC in 2020 for similar failures, said it accepted the findings and will comply with all the recommendations.

“We are sorry this has happened and we apologise to patients and the people who use our services,” it said in a statement.

(Reporting by Padraic Halpin; Editing ​by Kirsten Donovan)