HSE fined after medical records found in contaminated storage sites
Ireland’s Data Protection Commission has fined the Health Service Executive €645,000 after finding serious and systemic failures in its storage and retention of paper records containing sensitive medical information.
The inquiry followed breaches reported in October and November 2023. Intruders gained access to records stored at two former psychiatric hospitals: St Loman’s Hospital in Mullingar, which was contaminated with asbestos, and St Conal’s Hospital in Letterkenny, where parts of the building were affected by severe mould.
Videos posted on social media drew attention to the exposed records. In April 2024, the HSE learned – again through social media – that individuals had accessed a basement at St Loman’s containing further records described as old mental-health files.
The DPC inspected 12 HSE storage locations to determine whether the problems were isolated. It found documents damaged or effectively destroyed by mould, contaminated by animal droppings, covered by rubble, rotting because of their storage conditions or affected by water.
Records were being kept in disused bathrooms and cubicles, derelict buildings and a shipping container inside a turf shed. Some facilities lacked functioning lighting or heating, while the records were not arranged in a manner allowing them to be reliably identified, located or retrieved.
The DPC found infringements of Articles 5(1)(f) and 32(1) GDPR because appropriate security and records-management measures had not been implemented. It also found a breach of the storage-limitation principle because information had been retained in identifiable form for longer than necessary.
Further infringements concerned failures to notify the DPC within 72 hours and to communicate the breaches to affected individuals. The penalties comprised €300,000 for the security infringements, €300,000 for excessive retention, €30,000 for breach-notification failures and €15,000 for failing to inform data subjects.
The HSE must audit every facility in which it stores paper files, introduce systems capable of tracing records, destroy information that is no longer required and move records away from unsuitable locations. It must also test compliance with its retention and storage policies regularly.
The decision demonstrates that information security is not confined to digital systems. Controllers remain responsible for the confidentiality, integrity and availability of paper records throughout their lifecycle, including after files become operationally inactive or are transferred to remote storage.
Organisations should maintain complete inventories of archive locations, identify who is responsible for inspecting them and ensure that retention schedules produce defensible destruction rather than indefinite accumulation. Breach procedures must also capture physical intrusions and reports received through unconventional channels such as social media posts.
For more information, see our Practitioner Certificate in Records Management (PC.rm.).
