HSE fined €645,000 over data breach affecting Westmeath hospital

The Data Protection Commission has fined the HSE more than €600,000 over the mismanagement of historical records held at St Loman's hospital, Mullingar, and St Conal's Hospital, Letterkenny.

The fine was issued at the conclusion of an inquiry into the handling of paper records at the two facilities following a data breach identified in late 2023.

During the inquiry, the Data Protection Commission (DPC) found "significant deficiencies in HSE records management, data retention, security controls, breach reporting, and data protection governance".

The commission said these serious failings led to "personal data being retained for excessive periods, inadequately protected from damage or loss, and subject to breaches that were not reported or communicated in line with GDPR requirements".

At the conclusion of the inquiry, the commission issued "an order requiring the HSE to bring its processing activities into compliance and to provide a detailed implementation plan within 30 days".

It imposed administrative fines totalling €645,000 for "failures relating to data retention; failures relating to data security and confidentiality; failures to notify certain breaches to the DPC within required timelines; and failures to notify affected individuals of breaches".

The DPC's decision was issued on August 25.

The HSE responded by saying it has "already initiated a significant programme of remediation aimed at addressing the issues identified and complying with the (Commission's) order," with measures underway including the establishment of a "Records Management Steering Committee" and the creation of a "National Records Management Programme".

The HSE has the right to appeal the DPC's decision within 28 days of receiving it.