NHS Highland Reprimand For HIV Patient Email Data Breach
March 30, 2023NHS Highland has been reprimanded for a data breach which revealed the personal email addresses of people invited to use HIV services, according to ‘BBC’.
The health board used CC (carbon copy) instead of BCC (blind carbon copy) to send an email to 37 people.
Image Credit: Pixabay
The Information Commissioner's Office (ICO) said the error amounted to a "serious breach of trust”.
The mistake meant all recipients of the email could see the personal addresses of the others receiving it.
One person said they recognised four other individuals, one of whom was a previous sexual partner.
NHS Highland said it was sorry for the breach of confidentiality. The error was made on 13 June 2019.
The ICO issued the reprimand to the health board instead of a £35,000 fine.
It said failure to use BCC is one of the most common email data breaches, with nearly 1,000 reported incidents since 2019.
It called for improvements to be made to data protection safeguards for HIV service providers.
Stephen Bonner, deputy commissioner for regulatory supervision, said: “What we saw here with NHS Highland was a serious breach of trust, and those accessing vital services failed.
“Research shows that people living with HIV have experienced stigma or discrimination due to their status
“Organisations dealing with this type of information should take the utmost care with their personal data.
“Every HIV service provider in the country should look at this case and see it as a crucial learning experience.”
The ICO's recommendations have been included in NHS Highland's information governance action plan An update will provided to the ICO in June.
Under data protection laws, organisations have to have technical and organisational systems in place to ensure personal data is kept secure
NHS Highland said: “We acknowledge and accept the findings of the Information Commissioner and are doing all we can to prevent a repetition of this incident. "Since this incident, NHS Highland has changed email domain as part of a national roll out.
“We would take this opportunity to again apologise - unreservedly - to everyone who was affected by this incident.”
Read related myGwork articles here:
High Court Grants Permission To Appeal Decision Over Trans NHS Waiting Times
NHS Drops Discriminatory IVF Rules
NHS Bosses Have Blocked Health Advice For Pregnant Trans People For Almost A Year
Keep up to date with the latest myGnews