HSE records were found stored in disused bathrooms and cubicles, the DPC said.

The Data Protection Commission (DPC) has fined the HSE €645,000 for keeping paper medical records in battered conditions, after it found documents containing patients’ personal data destroyed by mould, contaminated with animal droppings and covered in rubble.

The watchdog was notified of the potential breaches in 2023 after people gained unauthorised access to paper records in the asbestos-contaminated St Loman’s Hospital, a former disused psychiatric facility in Co Westmeath, and St Conal’s Hospital in Co Donegal – also a former disused psychiatric hospital, contaminated with severe mould. The HSE used these locations as external storage facilities.

The HSE filed a breach notification in November 2023 regarding the incident at St Conal’s Hospital, and further informed the DPC in April 2024 of social media posts showing unauthorised access to the basement of St Loman’s Hospital. At the time, the HSE told the DPC that the records in question were “old”.

In its two-year-long investigation launched in May 2024, the DPC found that the HSE violated the GDPR across several instances, including by failing to ensure the security of the personal data stored in HSE’s external storage facilities, and failing to ensure patients’ personal information is not kept for longer than needed.

Furthermore, the HSE failed to inform the DPC of the breach in St Loman’s Hospital within 72 hours of becoming aware of the incident, and failed to inform the data subjects of the personal data breaches, the watchdog also found.

“During the site inspections, the DPC observed significant issues with documents damaged or effectively destroyed by mould, contaminated by animal droppings, covered in rubble or detritus, rotting due to the storage environment or water damaged,” said DPC deputy commissioner Graham Doyle.

“The DPC discovered storage areas in such profound disarray and neglect that the records contained within them could not be deemed to be filed in any organised or accessible manner. There were records stored in disused bathrooms and cubicles, a shipping container in a turf shed, rooms without functioning lighting or heating, as well as derelict buildings at a number of disparate locations.

“The retention of records by the HSE in an insecure manner beyond the period where they should be retained gives rise to an ongoing significant risk of unauthorised access to and disclosure of sensitive medical information by third parties. There is also the risk of records not being available for other medical care or other legal or regulatory reasons.”

Among its corrective measures, the DPC has ordered the HSE to carry out a complete audit for all storage facilities where it stores and retains paper files, destroy records with personal data that are no longer needed and establish a procedure to regularly evaluate HSE’s compliance with its own retention policies.

The HSE told SiliconRepublic.com that contaminated records at St Loman’s have been destroyed, while over-retained records at St Conal’s are also being destroyed.

However, this is not the first time the HSE has been found to be lacking appropriate security measures and control over personal data contained in paper healthcare records. The hefty fine handed today – the largest ever handed to a public body by the data protection watchdog – takes that into account, the DPC said.

“We are sorry this has happened and we apologise to patients and the people who use our services for data breaches at St Loman’s and St Conal’s sites and for our non-compliance with paper record retention and record management policies and procedures,” a spokesperson for the HSE told SiliconRepublic.com.

The health services authority said it is establishing and rolling out a comprehensive national records management programme of work, and updating policies regarding on the storage and retention of records.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.