Reprimand for NHS Fife after person entered hospital ward and accessed patients' personal information

The Information Commissioner’s Office (ICO) has issued NHS Fife with a reprimand following the incident, which happened in February.

The data protection watchdog found that the non-staff member was handed a document containing personal information of 14 people and assisted with administering care to a patient due to a lack of identification checks and formal processes.

Police have not been able to identify the person or recover the lost data, which was taken off site, with their investigations hindered by a lack of CCTV footage as the CCTV had been accidentally turned off by a staff member prior to the incident.

The ICO’s investigation concluded that NHS Fife did not have appropriate security measures for personal information, as well as low staff training rates. Following the incident, the health board introduced new measures such as a system for documents containing patient data to be signed in and out, as well as updated identification processes.

Natasha Longson, ICO head of investigations, said: “Patient data is highly sensitive information and must be handled with the appropriate security. When accessing healthcare and other vital services people need to trust that their data is secure and only available to authorised individuals.

"Every healthcare organisation should look at this case as a lesson learned and consider their own policies when it comes to security checks and authorised access. We are pleased to see NHS Fife has introduced new measures to prevent similar incidents from occurring in the future.”

The ICO recommended ways in which the health board could improve its data protection compliance and it has asked NHS Fife to provide an update of actions taken within six months of the reprimand being issued.

A spokesperson for NHS Fife said: “Earlier this year an individual purporting to be a member of agency nursing staff attended St Andrews Community Hospital.

“The individual was only on a ward for a short period of time and left shortly after being challenged by a member of the nursing team. While the person was never alone with any patient, they did have access to a handover document containing information relating to patients on the ward.

“NHS Fife and Fife Health and Social Care Partnership, who operate the facility, immediately reported the incident to Police Scotland and also referred the incident to the Information Commissioner’s Office. The patients involved and their families were informed of this breach of security.

“We acknowledge the findings of the Information Commissioner’s Office, and have apologised to those involved. A range of additional measures were put in place shortly after the incident to prevent such a matter from occurring again in future. We have since carried out a Significant Adverse Event Review and a working group has been established to implement the recommendations of both the Information Commissioner and the findings of our own review across the entirety of NHS Fife.”