The ICO reported earlier this month it reprimanded a GP practice for excessively disclosing medical records to an insurer.
In their published reprimand, the ICO illuminates what compliance safeguards it expects from all organisations – not only GPs – handling disclosures of information about health (‘special category’ data).
Having described the mistakes made in this case, the reprimand sets out the remedial steps taken after the incident by the GP practice.
David Doodson, ICO interim Head of Investigation, is quoted in the news report, saying:
“All personal information must be handled with care but health records – sensitive personal data – require particularly robust measures. This is because the loss of this kind of data can have distressing consequences for those involved. We recommend other organisations take note of the lessons learned from the mistakes [made] in this case.”
Simple, practical internal processes incurring no cost can help organisations ensure they have appropriate and compliant data protection practices.
Key facts
- In April 2024, Staines Health Group, the GP’s practice, received a request from a patient’s insurer (Vitality) stating that the patient required disclosing a copy of their medical history for a five-year period.
- The request stated that a copy of the medical records should be sent first to the patient for review, before being shared with the insurer.
- However, the GP’s practice disclosed 23 years of the patient’s medical records, and bypassed the patient, sending all the information directly to the insurer.
- The patient believed this excessive disclosure of unnecessary medical records led to a reduction in their insurance claim payout.
What data protection law provisions were breached?
The member of staff responsible for the breach had received data protection training when they first joined the GP’s practice. That training, delivered by an external provider of bespoke courses specifically for GP Practice staff, covered how to process insurance requests for medical records.
The ICO nevertheless concluded that processing was carried out in a manner that did not ensure appropriate security because:
- Despite known risks to patients, the practice did not have any policies, procedures or guidance in place to assist staff dealing with disclosure requests from insurers. An information governance policy, created on 28 August 2020 and scheduled for a review on 1 April 2021, was available. However, it contained no guidance to cover this specific topic. (The regulator was also unimpressed that the scheduled review and update of this policy had not taken place before the incident in July 2024 – three years after it was due).
- Staff were expected to remember and follow a process that, as in this instance, had been explained around two years prior, without ‘refresher’ training or access to a written process or policy to reference.
Personal data disclosed by the GP’s practice was not ‘limited to what is necessary in relation to the purposes for which it was processed’ so the ICO found there had been infringement of the ‘data minimisation’ principle (Article 5(1)(c) UK GDPR) as well as a reportable personal data breach.
Delayed breach report and flawed internal security procedure
Staines Health Group became aware of a potential data breach when the patient contacted them on 4 July 2024. Yet no report was submitted to the ICO until 30 July 2024. This was in excess of the legal requirement to report this incident no later than 72 hours after the GP’s practice had become aware of it.
The GP practice’s explanation for the delay was that internal security meant that the disclosure email (i.e. what was sent to the insurer) had been unavailable for their internal investigation. Security processes at the GP’s practice meant it was saved in a password protected zip file on a centralised system. Staff were expected to record passwords in a way that could be accessed by others in the team if required. However, in this instance, the member of staff involved omitted to do so before going on annual leave. This delayed internal investigation and reporting to the ICO.
The ICO’s reprimand flagged that while it often considered use of passwords to be an appropriate means of enhancing security, in situations such as this – where more than one member of staff is likely to work on or require access to secure documents – the use of passwords has potential to cause delays investigating a data breach, and it expected organisations to have arrangements which avoided this happening.
What remedial actions were taken?
The GP’s practice completed a ‘significant event’ investigation to establish the root cause of this incident and what lessons could be learned.
This led to practical remedial measures at the GP’s practice such as:
- Arranging further training and ‘refresher’ data protection training for all staff.
- Creating a written procedure document for staff to follow when handling insurance requests.
- Updating its existing process to include a ‘sign off’ sheet. It incorporated a checklist, enabling staff handling such requests to ensure the correct steps are followed. Also, a column was added to spreadsheets used by staff to record working on such requests, documenting whether the patient requestor required sight of their medical records before getting sent to their insurance company.
Lessons to be learned
This reprimand illustrates once again that the ICO will investigate and take enforcement action even if a case involves only one individual when there has been a serious breach involving ‘special category’ data.
Back in January 2024 we saw action taken in relation to an NHS trust which sent a standard letter, informing the father of a child patient about a medical examination appointment, to the wrong address. That letter reached others in the extended family, and although it contained only limited ‘special category’ information (basic details about the appointment, and a leaflet with advice) the disclosure caused significant distress to the parents of the child.
Again, in this earlier case, when the ICO investigated, the Trust was unable to evidence having formal documented processes or procedures to ensure regular updates of patient address details which would have reduced risk of this type of accidental personal data breach.
The ICO expects such risks to be identified and mitigated. While both incidents were caused by staff human error, the regulator looked for evidence that organisations fully and appropriately prepared staff for their duties in dealing with sensitive correspondence. Human error may be inevitable, but nevertheeless organisations are expected to anticipate the likelihood of this happening and have appropriate measures in place which mitigate such risks when sensitive personal information is involved.
More robust internal processes, clear written procedures for staff to follow, and refresher training would have mitigated risk in both situations.
In its news summary, the ICO’s list of lessons to be learned by other organisations include:
- Recognising the need for written processes to be in place to support staff when handling personal data.
- Giving consideration to the need for an internal ‘check’ or, to use its terminology, a ‘quality assurance process’ before disclosing sensitive personal data (such as ‘special category’ health data) outside the organisation (for example, having an internal ‘peer review’, having a colleague check that all is in order before medical records are shared).
- Awareness of the need to provide up-to-date and regular refresher data protection training for staff.
If you have any questions on any of the issues raised in the above article, please contact Sean Morris.