An investigation by the Data Protection Commission (DPC) into the storage of paper records by the HSE has found incidents of documents contaminated by animal droppings, destroyed by mould, covered in rubble, or rotting due to water damage.
Site inspections by DPC investigators found storage areas in states of “profound disarray and neglect”, with records being stored in disused bathrooms, a shipping container in a turf shed, rooms without functioning lighting or heating, as well as derelict buildings.
The DPC has imposed fines of €645,000 on the HSE for the breaches, and has also issued corrective orders.
The investigation was launched in May 2024 after people gained access to two disused psychiatric hospitals and posted videos to social media showing boxes of medical records and patient files that were being stored in the vacant hospitals.
The facilities in question were St Loman’s Hospital in Mullingar, Co Westmeath and St Conal’s Hospital in Letterkenny, Co Donegal.
As part of its investigation, the DPC carried out site inspections at 12 facilities across the country to establish if the cases highlighted on social media were isolated incidents or part of a systemic issue regarding the retention and storage of personal data contained in paper records, held by the HSE, in its external facilities.
“The DPC’s findings identified data protection failings concerning the physical conditions of HSE document storage facilities and the integrity of the documents held within those facilities,” the DPC said.
The data watchdog has ordered the HSE to carry out a complete audit of all storage facilities where paper files are retained, and to safely destroy any records containing personal data that are no longer needed for the purposes for which they are retained.
The DPC said that in calculating the fines imposed on the HSE, which are the largest it has ever imposed on a public body, it considered, as an aggravating factor, that the HSE committed similar previous infringements concerning the lack of appropriate security measures and the loss of control over personal data contained in paper healthcare records.
“The retention of records by the HSE in an insecure manner beyond the period where they should be retained gives rise to an ongoing significant risk of unauthorised access to and disclosure of sensitive medical information by third parties,” said Graham Doyle, DPC Deputy Commissioner.
“There is also the risk of records not being available for other medical care or other legal or regulatory reasons,” Mr Doyle said.
The HSE said it accepts the findings of the DPC investigation and added that it will comply with all the recommendations.
“We are sorry this has happened and we apologise to patients and the people who use our services for data breaches at St Loman’s and St Conal’s sites and for our non-compliance with paper record retention and record management policies and procedures,” a spokesperson said.
“Both facilities, while no longer used for clinical activity, had continued to operate as storage sites.
“As a result of the breaches, and in parallel with the DPC investigation, the HSE took steps to improve the security of the facilities, assess the condition of the records and safely destroy or relocate them as appropriate,” the HSE said.
The HSE said work is ongoing to address the failings identified.
“Developing a national, consistent and standardised approach to archiving and disposal of records is a key priority for the HSE,” the spokesperson said.