Health chiefs today launched a probe after boxes of patients’ private health records were left unattended in a hospital corridor for a week.
A shocked member of the public spotted at least six boxes of documents, including patients’ notes, sitting in Aberdeen Royal Infirmary (ARI) and contacted the Evening Express. After we showed NHS Grampian a photograph of the records the boxes were immediately removed from the corridor and an investigation was launched.
The health authority today said it was “extremely disappointed” in the data breach and vowed to get to the bottom of how it happened.
The documents were first spotted on Monday, January 29, near the staff gym, in an area of the hospital that is accessible from the main entrance. Some of the boxes were open and marked health records, with envelopes of notes from various wards clearly seen.
A member of the public took a photograph and contacted the Evening Express after returning to the area seven days later and discovering the documents were still there.
He said: “This is a serious breach of data protection. Patients’ medical notes were left out in a corridor that can easily be accessed by the public by stairs and a lift.
“The cage was full of boxes and they were full of notes. There was a table next to the cage and there was an open box with notes on full view.”
A spokeswoman for NHS Grampian said: “We are extremely disappointed to learn of this matter. Patients have the right to expect their data to be stored securely.
“Investigations into how this was allowed to happen are now under way. We take the issue of data protection very seriously. We regularly train our staff in the importance and procedures covering data protection for the people we serve, and will continue regular training and awareness raising.”
On Monday, NHS Grampian revealed hundreds of thousands of patient records will be moved to a secure location at ARI later this month. The exact location was not disclosed, however, to minimise the chances of a data breach. The documents in the corridor were not connected to this move, the NHS Grampian spokesman added.
Liberal Democrat MSP Mike Rumbles said: “Personal information such as patient records should always be kept secure. This is a clear breach of data protection rules and should never have happened.”
North-east Labour MSP Lewis Macdonald said: “Patients have the right to expect safe storage and transit of medical records, and I welcome assurances from NHS Grampian that this matter will be fully investigated.”