Hundreds of patients’ data put online after alleged breach

UNIVERSITY Hospital Limerick (UHL) is writing to more than 600 patients following an alleged data breach concerning patient information which was posted on social media.

Gardaí have also been informed of the alleged breach by a non-HSE employee.

It is alleged the data – including patients’ names, dates of birth and medicines they were dispensed – was extracted from a computer system relating to patients who attended the emergency department (ED) at UHL last April.

A hospital spokesman said it was writing to 630 patients who attended the ED between April 18-22.

“The data in question was extracted from an automated system used in the ED to dispense medication safely.

“It was extracted, without HSE knowledge or approval, by an employee of a company which was then supporting this system, and not by any employee of the HSE,” he added.

“This information was published online in the form of a file linked from a Twitter account. This file contained personal data which included patients’ names, date of birth and the names of medications dispensed while they were in the ED.” The medications were mostly painkillers and antibiotics.

The hospital became aware of the alleged breach on May 29. “Immediate actions were taken by the HSE and by UL Hospitals Group to protect patient data. Twitter blocked the link to the data and disabled the account in question,” the spokesman said.

Gardaí and the Data Protection Commission were also immediately notified and the HSE obtained a High Court order on June 5 last “restraining the individual concerned from communicating confidential information”.

It was believed the data has not been widely shared and it would have taken a degree of technical knowledge to rebuild.

The hospital was advising the 630 patients there remains a residual risk of future unauthorised disclosure despite the injunction that remains in place to restrain the individual from further sharing data.

“Where the patients concerned are children, we are writing to their parents or guardians. Of the 630 patients involved, 95 are children,” he added.