Peter A Clarke

Health records are amongst the most sensitive of information.  Information about a person’s fertility treatment are an even more sensitive category of information again.  It is not surprising that when there is a failure to keep data secure the regulator would take a strong line.  At least in the United Kingdom. In Australia, the regulator has not taken a strong line yet on anything of substance.

The UK Information Commissioner’s Office (the “ICO”) fined HCA International Ltd (“HCA”) £200,000 for failing to keep records secure. The problem stemmed from poor data handling at virtually all levels, including sending data overseas where it was processed by an Indian company using an unsecure server.

The media release provides:

The Information Commissioner’s Office (ICO) has fined a private health company, HCA International Ltd, for failing to keep fertility patients’ personal information secure.

The £200,000 monetary penalty has been issued as a result of an ICO investigation into the way the Lister Hospital was transferring, transcribing and storing records of IVF appointments.

The London hospital is part of a worldwide network of private health care facilities offering a range of services including fertility treatment. The issue was uncovered in April 2015 when a patient found that transcripts including details from interviews with Lister Hospital IVF patients could be freely accessed by searching online.

The investigation revealed the hospital had been routinely sending unencrypted audio records of the interviews by email to a company in India since 2009. Details of private conversations between a doctor and various hospital patients wishing to undertake fertility treatment were transcribed in India and then sent back to the hospital.

The ICO found the Indian company could not restrict access to the personal information because it stored audio files and transcripts using an unsecure server.

HCA International breached the Data Protection Act 1998 by failing to ensure that their sub-contractor acted responsibly.

Head of ICO enforcement, Steve Eckersley said:

“The reputation of the medical profession is built on trust. HCA International has not only broken the law, it has betrayed the trust of its patients.

“These people were discussing intimate details about fertility and treatment options and certainly didn’t expect this information to be placed online.  The hospital had a duty to keep the information secure. Once information is online it can be accessed by anyone and could have caused even more distress to people who were already going through a difficult time.”

Mr Eckersley added:

“What makes this case even worse is that we know the company is aware of its data protection obligations and already has appropriate safeguards in place in other areas of its business. The situation could have been avoided entirely if HCA International had taken the time to check up on the methods used by the contract company.”

The General Data Protection Regulation (GDPR), the new data protection law coming into force in the UK in May 2018, will strengthen the ICO’s powers to fine companies. Fines of up to four per cent of a company’s global turnover could be issued where a serious breach of data protection law has occurred.

The Monetary Penalty Notice relevantly provides:

Regarding the facts:

11. HCA owns private hospitals including the Lister hospita l in London (“hospital”). It provides a wide range of services to private patients including IVF treatment.

12. Since 2009, the hospital routinely sent unencrypted a udio recordings (“recordings”) by email to a data processor in India for transcription.  The recordings contained private consultations that took place with a doctor for patients wishing to undergo IVF treatment.

13. HCA was unaware that the data processor used an unsecured FTP server to store the recordings and then send completed transcripts to the hospital. The server did not have an authentication process to restrict access to the

14. On 8 April 2015, a patient informed the hospital that transcripts of consultations that took place in March/April 2015 containing confidential and sensitive personal data, could be accessed via an internet search

The key findings were:

18.  HCA failed to take appropriate technical measures against unauthorised or unlawful processing of personal data in contravention of the seventh data protection principle …

which was particularised as follows, at [21]:

• HCA sent unencrypted recordings by email to the data processor in
• HCA had no guarantee that the data processor would use a secure FrP server to store the recordings and then send completed transcripts to the hospital.
  
• HCA had no guarantee· that the data processor would erase the recordings after they had been transcribed.
• HCA failed to monitor the data processor in relation to any security measures taken by him, and
• HCA did not have a DPA compliant contract with the data processor in relation to the processing.

and that the breach was forseeable in that:

40.  In the circumstances, HCA ought reasonably to have known that the recordings containing transcripts would be vulnerable to a security breach in the absence of appropriate security

41. Second, the Commissioner has considered whether HCA knew or ought reasonably to have known that this contravention would be of a kind likely to cause substantial distress. She is satisfied that this condition is met, given that HCA was aware of the nature of the personal data contained in the transcripts. Therefore, it should have been obvious to HCA that such a contravention would be of a kind likely to cause substantial distress to the affected individuals.

42. Third, the Commissioner has considered whether HCA failed to take reasonable steps to prevent the contravention. Again, she is satisfied that this condition is met. Reasonable steps in these circumstances would have entailed sending encrypted recordings to the data processor; having a gua rantee that the data processor would use an SFTP server with TLS 1.2 cryptography to store the recordings and then to send completed transcripts to the hospital; having a guarantee that the data processor would erase the recordings after they had been transcribed; monitoring the data processor in relation to any security measures taken by him and having a DPA compliant contract with the data processor in relation to the processing. HCA failed to take any of those steps. The Commissioner considers that there was no good reason for that failure.

As a result the ICO imposed a monetary penalty of £200,000 which would be reduced to £160,000 if paid by 27 March 2017.