The Information Commissioner’s Office has fined the Health and Social Care Trust in Belfast £225,000 – the second largest fine it has ever issued – for leaving paper documents in a disused hospital.
Belfast’s Belvoir Park Hospital was closed in 2006. Despite the fact that the trust installed CCTV cameras and employed security guards to patrol the site, trespassers gained entrance on numerious occasions, photographed some patient records that had been left in the hospital and posted their pictures on the Internet.
Many of the photos can still be seen on the urban exploration web forum 28dayslater.co.uk.
The Trust was unaware of this until it was tipped off by the media in 2010. It increased security and conducted an investigation, which discovered "several thousand records of infectious disease patients some of which dated back to the 1950s and several thousand X-ray images".
"If the Trust had known about the records [they] would have been subject to our Retention and Disposal Schedule and in this respect controls failed," the Trust said in its annual report last year.
It put in place a plan to remove all the materials by June 2011, although this was hampered by the discovery of asbestos at the site.
Crucially, however, the Trust did not inform the ICO about the incident.
The ICO said today that it issued the fine because the Trust had failed to take sufficient precautions against the loss of data. "The [Trust] knew or ought to have known that there was a risk that the contravention would occur, and that such a contravention would be of a kind likely to cause substantial distress, but failed to take reasonable steps to prevent the contravention.
"The Commissioner has taken this view because of the large amount of confidential and sensitive personal data relating to patients and staff held on the site. The data controller was used to dealing with such information and had taken some steps to safeguard the records on site even though the steps taken were inadequate.
The fact that the Trust did not report the issues to the ICO, and that some affected individuals complained, added to the fine. However, mitigating factors included the discovery of asbestos at the site, and that the Trust has cooperated with the ICO’s investigation.
The Trust has apologised for the incident. "The records concerned are historical and do not concern any current patients," it said in a statement. "This in no way excuses the distress this may have caused, something we apologise for.
"The fine will be paid from efficiency savings and will not affect patient care."
