HSE fined €645,000 for record storage failures

The Health Service Executive (HSE) has been fined €645,000 by the Data Protection Commission (DPC) for serious failures in the storage and security of personal medical records. The penalty follows an investigation that uncovered sensitive patient documents stored in conditions described as neglectful and unfit for purpose, including locations contaminated by mould, water damage, and animal droppings. The inquiry, which began in May 2024, was prompted by two data breaches reported in October and November 2023. These incidents involved unauthorized access to paper records stored at St. Lomans Hospital in Mullingar, County Westmeath, and St. Conals Hospital in Letterkenny, County Donegal. Videos posted on social media highlighted the poor storage conditions at both former psychiatric hospital sites. The HSE later informed the DPC of additional unauthorized access to records stored in the basement of St. Lomans Hospital. In response, the DPC conducted inspections at 12 HSE facilities nationwide to assess the extent of the issues. Inspectors found records stored in disused bathrooms, cubicles, shipping containers, turf sheds, and derelict buildings.