Personal data breaches and related incidents

Health and care organisations are committed to handling information safely and securely.

In this guidance:

• an incident is where there is a problem with a network and information system, for example, a computer system which impacts upon health and care services
• a personal data breach is when identifiable information is impacted for example it is lost

Some incidents may result in a personal data breach, for example, a cyber incident where IT systems go down and data is stolen by criminals. Other incidents may not result in a personal data breach, for example, where an IT system used for tracking which medical equipment needs servicing goes down.

Health and care organisations hold data about you and are required by law to keep this information secure. This includes electronic and paper records.

However, accidents may occasionally happen, and your records could be impacted such as:

• being shared inappropriately, for example with another patient with the same name
• being mistakenly destroyed, for example being mixed up with a set of records that are due for destruction
• becoming unavailable, for example due to an IT system going down
• being changed so they become inaccurate, for example due to a glitch when a new IT system is installed

If this happens, steps will be taken to ensure that:

• it doesn’t happen again
• the risks to you and your care are minimised
• everyone learns from the mistake

If there is a breach to the security of your information and there is a high risk to your rights and freedoms, you should be informed by your health and care organisation. If there is a potential risk to you, your health and care organisation will also inform the Information Commissioner’s Office (ICO), for example, if your personal information was lost in a public place. Your health and care organisation may contact you directly, for example, by sending you an email or letter. Alternatively, they may put information on their website.

If you are dissatisfied with the outcome of your complaint, you can contact the Information Commissioner’s Office. The Information Commissioner's Office has provided advice and some wording to use if you are worried about how an organisation has handled your information.