March 6, 2017

The Information Commissioner’s Office has fined a private health company, HCA International Ltd, for failing to keep fertility patients’ personal information secure.

The £200,000 monetary penalty has been issued as a result of an ICO investigation into the way the Lister Hospital was transferring, transcribing and storing records of IVF appointments.

The London hospital is part of a worldwide network of private health care facilities offering a range of services including fertility treatment. The issue was uncovered in April 2015 when a patient found that transcripts including details from interviews with Lister Hospital IVF patients could be freely accessed by searching online.

The investigation revealed that the hospital had been routinely sending unencrypted audio records of the interviews by email to a company in India since 2009. Details of private conversations between a doctor and various hospital patients wishing to undertake fertility treatment were transcribed in India and then sent back to the hospital.

The ICO found that the Indian company could not restrict access to the personal information because it stored audio files and transcripts using an unsecure server. Therefore, HCA International had breached the Data Protection Act 1998 by failing to ensure that their sub-contractor acted responsibly.

Head of ICO enforcement, Steve Eckersley said: “The reputation of the medical profession is built on trust. HCA International has not only broken the law, it has betrayed the trust of its patients. These people were discussing intimate details about fertility and treatment options and certainly didn’t expect this information to be placed online. The hospital had a duty to keep the information secure. Once information is online it can be accessed by anyone and could have caused even more distress to people who were already going through a difficult time”.

The ICO reminds readers that the new General Data Protection Regulation, coming into force in the UK in May 2018, will strengthen the ICO’s powers to fine companies. Fines of up to 4% of a company’s global turnover could be issued where a serious breach of data protection law has occurred. To read the ICO’s press release and for a link to the monetary penalty notice, click here.