New guidelines after data breaches at UHG
New guidelines for supervising students conducting research at University Hospital Galway (UHG) were put in place following the discovery of a serious breach of data protection of female patients at the hospital.
The guidelines were put in place in response to one of a number of data protection breaches, including release of sensitive information about patients and minors, within the health service in Galway in the past year.
All bar one of the incidents were reported to the Data Protection Commissioner, according to Health Service Executive internal documents released under the Freedom of Information Act.
The Galway breaches are among 100 data protection breaches by the HSE across the country.
One of the local breaches included a research student at University Hospital Galway being given the names and addresses of women patients – the student contacted the patients at their homes.
The breach deviated from ethics approval guidelines.
Following an investigation, the HSE said “steps have been put in place to ensure adequate supervision of students conducting research”.
Letters of apology were issued to all patients, and “all consent forms and other personal data have been returned”.
Another local case involved a therapists’ diary being “mislaid”. The names and surnames of the therapists’ patients were included in the diary but not their addresses.
The misplaced diary was found and the Data Protection Commissioner was not informed by Galway Community Service.
A separate incident involving Galway Community Service involved a response to a Freedom of Information internal review which was sent to an incorrect email address containing a decision letter and schedule of records. No records were issued.
In the Galway disability services, an autism assessment report for a child was sent to the wrong address and the parents of another child received the report in error.
According to the HSE, “the report was retrieved and the parents of the child whose data was breached were contacted to explain the incident and an apology was issued”.
In a similar incident in the occupational therapy department of UHG, a referral letter for a minor was “inadvertently sent to the wrong address as it was accidentally included in an envelope with another referral.”
In this case, the HSE said the referral letter was retrieved and the parents of the child were contacted with an explanation and apology.
Nationally, among the breaches was a case in Cork where a patient file was found by a member of the public in a drawer of a filing cabinet in a second-hand furniture shop.
In another incident in Sligo, a diary with sensitive information was misplaced by a community services worker and was later found on the roof of a car.
In all some 103 data breaches occurred between April 1, 2014 and April 1 of this year across the HSE.