HSE fined €645,000 for storing records in decrepit conditions

The Data Protection Commission (DPC) has imposed a substantial fine of €645,000 on the Health Service Executive (HSE) for improper storage of paper medical records in deteriorating conditions. The records, which contained patients' personal data, were found in disreputable locations like decaying bathrooms, cubicles, a shipping container, and derelict buildings at former psychiatric hospitals in Co Westmeath and Co Donegal.

The DPC discovered these breaches in 2023 after unauthorized individuals gained access to the records in the contaminated hospitals. The HSE had been using these locations as external storage facilities before notifying the DPC in November 2023 and April 2024, respectively. During their investigation, the DPC uncovered multiple instances of the HSE violating the General Data Protection Regulation (GDPR), including inadequate security measures, failure to retain patients' personal information for only as long as necessary, and not informing the DPC or the data subjects of the breaches within the 72-hour timeframe, as mandated by the GDPR.

DPC deputy commissioner Graham Doyle expressed severe concern over the neglect and disarray of the records stored, which were damaged by mould, contaminated with animal droppings, covered in rubble, or water-damaged. The DPC recommended a complete audit of all storage facilities for paper files, destruction of records with personal data that are no longer needed, and the establishment of a regular evaluation procedure to ensure compliance with the HSE's retention policies.

The HSE has acknowledged the destruction of contaminated records at St Loman’s and St Conal’s sites and is currently rolling out a comprehensive national records management programme, updating policies regarding the storage and retention of records.