Data breach at Betsi Cadwaladr health board after patient details sent to wrong address

The Information Commissioner’s Office (ICO) has found Betsi Cadwaladr University Health Board in breach of the Data Protection Act after sensitive information was sent to the wrong address.

Eight letters containing patient information which should have been sent out to a GP were sent to one patient in July 2013 – six of the letters included sensitive medical information relating to patients’ treatment.

An ICO investigation found that the employee responsible for the mistake hadn’t received any form of data protection training.

While the health board had introduced mandatory data protection training for all staff in April 2013, by February 2014 only 6.5% of staff had received it.

The health board informed the ICO that it did not anticipate providing the training to all of their staff until April 2015.

ICO Assistant Commissioner for Wales, Anne Jones, said:

“We accept mistakes can happen, but organisations must make sure employees handling sensitive personal information are given the necessary training to carry out their role. Betsi Cadwaladr University Health Board failed to do this.

“The health board has now signed an undertaking committing the organisation to improving the training provided to its employees. This includes prioritising staff who manage sensitive information as part of their core role, or who work in a lead information governance role within the organisation by ensuring they’ve received data protection training by 30 September 2014. The health board will also make sure their staff complete refresher training every two years.

“These improvements will significantly reduce the risks of a future breach occurring and help to keep patients’ information secure.”