London NHS trust fined for HIV service data breach

A London NHS trust has been fined £180,000 after a data breach regarding personal information of over 700 users of an HIV service.

The email addresses of the patients were shared when a newsletter was sent out to users that included the addresses of all other recipients.

The issue occurred at 56 Dean Street, a Soho-based sexual health clinic run by Chelsea and Westminster Hospital NHS Foundation Trust.

Addresses had been mistakenly copied into the wrong field, and 730 of the 781 email addresses contained people’s full name.

The Information Commissioners Office decided to administer the fine after ruling that there had been serious breach of the Data Protection Act, which was likely to have caused substantial distress.

It was also not the first instance of this kind of data breach, as a similar error had occurred in March 2010 when a questionnaire was sent out to 17 patients that included the email addresses of all recipients.

Information Commissioner Christopher Graham said: “People’s use of a specialist service at a sexual health clinic is clearly sensitive personal data. The law demands this type of information is handled with particular care following clear rules, and put simply, this did not happen.

“It is clear that this breach caused a great deal of upset to the people affected. The clinic served a small area of London, and we know that people recognised other names on the list, and feared their own name would be recognised too. That our investigation found this wasn’t the first mistake of this type by the Trust only adds to what was a serious breach of the law.”