Discovery of confidential documents leads to £100,000 penalty

News released from the Information Commissioner’s Office (ICO) yesterday: a penalty of £100,000 was imposed on Stockport Primary Care Trust after the discovery of a large number of patient records at a site it formerly owned.

The discovery was made by new owners when they bought the premises in 2011.  The boxes of waste contained personal information including work diaries, letters, patient records, referral forms and various documents. Some of the information contained particularly sensitive data including details of miscarriages, incontinence problems, child protection issues and a police report relating to the death of a child.

The boxes had been left behind by Stockport Primary Care Trust which subsequently collected the information.

An investigation by the ICO revealed two earlier security incidents where confidential and highly sensitive personal data had been left behind in secure buildings owned by the trust.

Stockport Primary Care Trust was dissolved on 31 March 2013 with their legal responsibilities passing to the NHS Commissioning Board. The board will be required to pay the penalty amount by 3 July or serve a notice of appeal by 5pm on 2 July.

The ICO will also be speaking to NHS Stockport Clinical Commissioning Group to pass on the learning that should be taken from this incident.

David Smith, Deputy Commissioner and Director of Data Protection, said:

“It’s crucial that organisations don’t take their eye off the ball when moving premises. This NHS trust’s efforts to keep its patients’ confidential records secure were completely undermined by its failure to properly decommission the premises it was leaving.

“The highly sensitive nature of the documents left behind makes this mistake inexcusable, and there can be no doubt that the penalty we’ve served is both necessary and appropriate.

“In the last year we have served two six figure penalties on organisations that have left large volumes of personal information behind when leaving a site. These penalties highlight the need for organisations to have effective decommissioning procedures in place and to make absolutely sure that these procedures are followed in practice.”

More about this story here.