The Health Service Executive (HSE) has been fined €645,000 after an inquiry found medical records had been destroyed by mould, contaminated by animal droppings, covered in rubble or rotted due to water damage.
The Data Protection Commission (DPC), which imposed the fines, is the national supervisor responsible for enforcing data privacy law. The DPC said its inquiry that began in May 2024 was taken as a result of two personal data breaches.
These were notified to the DPC in October 2023 and November 2023.
On both occasions, people gained unauthorised access to paper records stored and retained at two former disused psychiatric hospitals.
The first incident occurred at St Loman’s Hospital, which is contaminated with asbestos, in Mullingar, Co Westmeath.
The second incident took place at St Conal’s Hospital, which is contaminated with severe mould, in Letterkenny, Co Donegal.
TikTok video revealing access to medical records spurs inquiry into HSE data breaches
TikTokkers find death records in former psychiatric hospital in Westmeath
Videos uploaded to social media highlighted that medical records, such as death records, were stored in both facilities.
In April 2024, the HSE informed the DPC that it became aware, through social media, that there had been unauthorised access to the basement of St Loman’s Hospital, where further records were being stored.
The DPC said it was told by the HSE that these records were “old mental health” records.
The DPC found during site inspections that documents were “damaged or effectively destroyed by mould, contaminated by animal droppings, covered in rubble or detritus, rotting due to the storage environment or water damaged”.
It also discovered storage areas in “such profound disarray and neglect that the records contained within them could not be deemed to be filed in any organised or accessible manner”.
Records were found to be stored in disused bathrooms and cubicles, a shipping container in a turf shed, rooms without functioning lighting or heating as well as at derelict buildings at a number of locations.
As part of the inquiry process, the DPC carried out 12 site inspections nationwide to establish whether the issues identified in the breach notifications were isolated incidents or whether the issues were systemic.
The DPC identified data protection failings concerning the physical conditions of HSE document storage facilities and the integrity of the documents held there.
It ordered the HSE to carry out a full audit of all storage facilities to ensure they are fit for purpose.
The DPC said, in calculating fines, it considered, as an aggravating factor, that the HSE committed similar previous infringements concerning the lack of appropriate security measures and the loss of control over personal data contained in paper healthcare records.
DPC deputy commissioner Graham Doyle said: “the retention of records by the HSE in an insecure manner beyond the period where they should be retained gives rise to an ongoing significant risk of unauthorised access to and disclosure of sensitive medical information by third parties.”
The HSE said it acknowledges and accepts the report findings and work is ongoing to address the failings identified.
“We are sorry this has happened and we apologise to patients and the people who use our services for data breaches at St Loman’s and St Conal’s sites and for our noncompliance with paper record retention and record management policies and procedures.
“Developing a national, consistent and standardised approach to archiving and disposal of records is a key priority for the HSE.”