ICO reprimands GP surgery over excessive disclosure of medical records

The Information Commissioner’s Office (ICO) has issued a formal reprimand to Staines Health Group after the GP surgery disclosed 23 years of medical records to an insurer. The incident occurred after the insurance company requested five years of medical history to process a claim for a terminally ill patient. Although the records were supposed to be sent to the patient first, the surgery sent more than two decades of data directly to the insurer. The patient believes that the excessive disclosure of unnecessary medical records led to a reduced payout.

The ICO found that the surgery lacked written procedures for insurance requests and failed to provide regular data protection training. Since the breach, Staines Health Group has introduced a formal sign-off process, drafted new staff guidelines, and placed the responsible employee under supervision for 6 months.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.