Bayswater Medical Centre (BMC) in London has been fined £35,000 by the Information Commissioner’s Office (ICO) after it left highly sensitive medical information in an empty building.
In July 2015, BMC moved out of a former GP surgery but continued to use the premises for storage purposes.
In 2016, representatives of another GP surgery were allowed to visit the vacant building with a view to taking over the lease.
Once inside, they found unsecured medical records and other sensitive information and informed BMC, but the owners took no action to secure the data, despite repeated warnings by both the other surgery and the local Clinical Commissioning Group.
In February 2017, officers from NHS England visited the site and found a large quantity of highly sensitive information left on desks, in unlocked cabinets and in bins. They ordered BMC to remove the information the next day.
The ICO ruled that:
- BMC failed to secure the premises or the data stored there, and allowed unsupervised access to the premises by others, who were not authorised to view the data;
- BMC should have known that that exposing this highly sensitive personal information – and potentially losing it -would have caused substantial damage and distress; and
- The contravention was heightened by BMC’s failure to take prompt action to protect patient data for such a long time.
The ICO found that the severity of the breach merited a fine of £80,000, but this was reduced to £35,000 after BMC’s ability to pay was taken into account.
