HSE fined €645k over records covered in animal droppings

The Data Protection Commission (DPC) has imposed a substantial €645,000 fine on the Health Service Executive (HSE) due to the poor storage conditions and loss of integrity of paper records held in external facilities. The investigation, launched in May 2024, revealed that records had been contaminated by animal droppings, damaged by mould, hidden under rubble, or rotting due to water damage.

Site inspections discovered storage areas in disarray, with documents stored in substandard conditions, ranging from disused bathrooms to shipping containers in turf sheds and derelict buildings. The DPC has also issued corrective orders, mandating the HSE to conduct a comprehensive audit of all storage facilities retaining paper files and to destroy any records containing personal data that are no longer needed.

The fines, the largest ever imposed on a public body, were increased due to the HSE's history of previous infringements concerning security measures and control over personal data. The DPC's deputy commissioner, Graham Doyle, emphasized the significant risks posed by the inadequate storage, including unauthorized access to sensitive medical information and unavailability of records for medical care, legal, or regulatory purposes.

The HSE acknowledged the findings and pledged compliance with the DPC's recommendations, expressing regret over the breaches and non-compliance with record retention policies. Both facilities, though no longer in clinical use, continued to function as storage sites. The HSE has since taken measures to enhance facility security, assess record conditions, and ensure appropriate destruction or relocation.

Addressing these failings and developing a standardized approach to record archiving and disposal remains a key priority for the HSE.