HEALTH BOARD IN DATA BREACH PROBE
Investigation as employee found to have inappropriately accessed info
Police have been called in to investigate a data breach at NHS Lanarkshire which could have affected dozens of women.
Health board chiefs have sent letters to patients apologising following allegations that a male member of staff inappropriately accessed the personal details of patients who had attended the radiology department.
The News understands from two sources that the breach took place at University Hospital Hairmyres in East Kilbride as police confirmed the investigation is linked to a similar one in NHS Ayrshire & Arran.
The letter goes on to state that NHS Lanarkshire “have become aware” that the staff member allegedly contacted patients of that health board via text and WhatsApp messages, and that personal details were accessed.
One of the patients affected is Stephanie Torlay, 26, from Westwood and she and husband David are now demanding answers.
Mrs Torlay told the News: “This has made me extremely nervous.
“I have been having bouts of anxiety and depression since I got the letter – you expect personal details held by the likes of the NHS to be secure.”
A police probe has been launched following an NHS Lanarkshire data breach which could have affected dozens of women.
The health board confirmed that cops had been called in after allegations were made that a male member of staff inappropriately accessed patient records.
The News understands from two sources that the breach took place at University Hospital Hairmyres in East Kilbride.
And the husband of one patient says he believes “at least 100 women” could have been affected as he demanded: “We want answers now.”
The staff member is subject to an internal investigation and can no longer access NHS Lanarkshire information systems.
A letter of apology has been sent out by health chiefs to patients whose personal details may have been compromised.
It states that the male member of staff involved worked at the radiology department and the breach happened between January 1, 2017 and April 8, 2018.
The letter goes on to say that details – including names, addresses, phone numbers, patients’ GP details and date of birth along with why an x-ray was ordered – were wrongly accessed.
NHS Lanarkshire “have become aware” that the staff member allegedly contacted patients of another health board, NHS Ayrshire & Arran, via text and WhatsApp messages. A probe has been launched following allegations made at Kilmarnock’s Crosshouse Hospital, East Ayrshire. Police yesterday confirmed the investigations are linked.
Stephanie Torlay, 26, from Westwood is one of the patients affected.
“I have a condition which means my joints randomly dislocate and I need to have regular x-rays,” she said.
“This has made me extremely nervous. I don’t know who this person is and why they would want my personal details.
“I should have went for an x-ray recently but this stopped me. But since I don’t have a name for this person how am I to know if he has tried to contact me.
“I have been having bouts of anxiety and depression since I got the letter – you expect personal details held by the likes of the NHS to be secure.
“And I want to know why police have seemingly just been called in if the health board have known about it for months now?”
The letter said the staff member had “no legitimate, clinical or administrative” requirement to access Mrs Torlay’s data.
Husband David added: “We want answers now and I have been in contact with others – all women – with at least 100 that we know of possibly affected by this.”
The health board’s director of public health and health policy, Gabe Docherty, said: “NHS Lanarkshire was alerted to the fact that a member of staff may have inappropriately accessed patient records.
“We acted promptly to start an investigation and ensure the member of staff no longer had any access to NHS Lanarkshire information systems. As part of our investigation we are contacting patients whose records have been accessed.
“NHS Lanarkshire takes incidents like this extremely seriously and we have written to offer our sincere apologies to those affected. We are working closely with Police Scotland and the Information Commissioner’s Office.
“As this is an ongoing police investigation, we are not able to confirm any further details.”
The health board was unable to confirm how many letters of apology had been sent to patients.
A Police Scotland spokeswoman added: “We can confirm that Police Scotland has received a complaint regarding inappropriate behaviour of a male member of staff at NHS Lanarkshire.
“Enquiries are ongoing.”