The UK’s Information Commissioner’s Office (ICO) has called for “substantially improved” data protection processes for organizations handling information on people living with HIV after reprimanding the NHS agency.
NHS Hyland said it sent emails to 37 people who were likely accessing HIV services, but accidentally used the CC feature instead of the BCC feature, exposing each other’s details.
According to the ICO, one person confirmed that he recognized four other individuals on the mailing list. One of them was her former sexual partner. Two patients have filed a formal complaint with her NHS Highlands, one of whom has filed multiple complaints.
Read more about the NHS ICO scrutiny.
NHS Highland escaped a £35,000 fine in line with the regulator’s new light touch approach with public sector bodies, but the ICO accused the Health Commission of a “serious breach of trust”.
We have also taken the opportunity to remind all organizations that handle this type of highly sensitive information that they must exercise extra caution.
The ICO’s deputy director for regulatory oversight, Stephen Bonner, argued that HIV service providers need to set the highest standards in data protection.
“The stakes are too high. Research shows that people living with HIV experience stigma and discrimination because of their status, and this means that organizations handling this kind of information take great care with personal data. It means you have to pay,” he added.
“All HIV service providers in the country should see this case and see it as an important learning experience. We urge organizations to raise data protection standards and take appropriate measures to keep people safe.” I am asking you to teach me.”
As part of the disciplinary action, NHS Highlands has reviewed its data protection and email policies, including the use of group emails, to ensure that group emails containing highly sensitive information have “adequate technical and organizational The ICO said it should also consider conducting a GDPR training compliance assessment within the UK.
