Ireland‘s health service operator has been fined €645,000 by the country’s data regulator after medical records were found in “profound disarray” in areas including a turf shed and a disused bathroom that, in some cases, were contaminated by animal droppings.
The Data Protection Commission imposed the record fine for an Irish public body on Wednesday after inspecting 12 storage sites to determine whether personal data breaches at two former disused and “mould-contaminated” psychiatric hospitals where medical records were being stored were systemic issues.
The DPC identified data security failings concerning the physical conditions of storage facilities and the integrity of documents held at the sites by the Health Service Executive (HSE), which runs Ireland’s public health and social care service.
“During the site inspections, the DPC observed significant issues with documents damaged or effectively destroyed by mould, contaminated by animal droppings, covered in rubble or detritus, rotting due to the storage environment or water damaged,” DPC Deputy Commissioner Graham Doyle said in a statement.
“The DPC discovered storage areas in such profound disarray and neglect that the records contained within them could not be deemed to be filed in any organised or accessible manner
“There were records stored in disused bathrooms and cubicles, a shipping container in a turf shed, rooms without functioning lighting or heating, as well as derelict buildings at a number of disparate locations.”
The unsecure retention of records beyond the period they should be kept risked unauthorised access to sensitive medical information, Doyle said. Some of the records were “effectively destroyed” by mould, covered in rubble or rotting.
The data watchdog ordered the HSE to carry out a complete audit of all storage facilities, remove records from any unit not fit for purpose and implement an appropriately designed management system for all paper records.
The HSE, which was also fined €65,000 by the DPC in 2020 for similar failures, said it accepted the findings and will comply with all the recommendations.
“We are sorry this has happened and we apologise to patients and the people who use our services,” it said in a statement.