An NHS trust has been fined £90,000 after what the watchdog called a serious breach of the Data Protection Act (DPA). The Information Commissioner’s Office (ICO) announced the offender was the Central London Community Healthcare (CLCH). The breach first occurred in March 2011, after patient lists from the Pembridge Palliative Care Unit, intended for St John’s Hospice, were faxed to the wrong recipient. The individual informed the trust in June that they had been receiving the patient lists – around 45 faxes over a three month period – but had shredded them.
The patient lists contained sensitive personal data relating to 59 individuals, including medical diagnoses and information relating to their domestic situations and resuscitation instructions.
The ICO found that the trust failed to have sufficient checks in place to ensure that sensitive information sent by fax was delivered to the correct recipient. The trust also failed to provide sufficient data protection guidance and training to the member of staff concerned.
Stephen Eckersley, the ICO’s Head of Enforcement said: “Patients rely on the NHS to keep their details safe. In this case Central London Community Healthcare NHS Trust failed to keep their patients sensitive information secure. The fact that this information was sent to the wrong recipient for three months without anyone noticing, makes this case all the more worrying.”
