Privacy row as medical files found on pavement

Thousands of data breaches

PATIENTS’ notes that were found on pavements outside hospitals are among thousands of confirmed data breaches committed by the NHS in Scotland.

At least 2,100 people are known to have had their data compromised in the past four years, although the true figure is feared to be much higher.

In total, there have been more than 9,800 investigations into data breaches across NHS health boards in Scotland since 2019, with almost 2,000 taking place this year alone.

The incidents included email errors, sensitive data being lost or stolen and staff inappropriately accessing patient records, including those of neighbours and relatives.

In one incident recorded at NHS Highland, ‘paper ward handover notes’, which contained details of 19 patients, were found on the pavement outside a hospital.

Campaigners have hit out at the situation, calling for an investigation into the ‘major failures’.

While some incidents involved the misuse of personal details such as phone numbers and addresses, others were breaches of clinical information including medical notes.

An error at NHS Highland in 2019 saw 37 people who had HIV receive an email in which recipients could see the email addresses of other patients, thereby revealing their medical condition. In Scotland, the number of potential breaches has increased year-on-year, with a total of 2,206 in 2019 and 2,316 in 2020, rising to 3,139 in 2021.

There were already 1,936 reports up to September this year.

Only four NHS boards provided information about the number of people affected by data breaches, with others recording only incidents where a probe was launched.

Roger Livermore, of Action for a Safe and Accountable People’s NHS, said: ‘Confidentiality is important for patients. The scale of the data breaches shows major failures.

‘They are likely to be substantially under-reported. More breaches will be occurring but will be hidden or not be recorded.

‘Given the scale of the problem, it would seem to justify a special investigation internally by NHS Scotland and by an external body.’

The figures provided by some health boards include reports of potential as well as actual breaches, and of the thousands of incidents recorded, only a small number were deemed serious enough to be referred to the Information Commissioner’s Office (ICO).

Scottish Tory health spokesman Dr Sandesh Gulhane called on the Scottish Government to take action ‘as a matter of urgency’, adding: ‘These figures are shocking and will deeply alarm patients.’

NHS Highland said it was ‘very sorry for the distress and concern’ caused by the data breaches.

A Government spokesman said: ‘We take data breaches within the NHS very seriously and work closely with the ICO to ensure NHS boards are supported and lessons learnt.’

‘This will deeply alarm patients’