NHS Forth Valley admit personal details of 150 women shared in data breach

NHS Forth Valley has admitted it is now investigating the data breach by one of its employees.

The women whose information was involved have all been contacted by the health authority in recent days.

One of those whose details were breached said she had “significant concerns”.

After receiving the initial contact from NHS Forth Valley, in a letter signed by director of midwifery Mairi McDermid, the new mum requested further information and was told that the data breach involved “a fully qualified NHS employee not a junior”.

However, today (Thursday), NHS Forth Valley stressed that the person involved in the breach was not a clinical member of staff.

She said: “The spreadsheet reportedly included my full name, date of birth, address, NHS number, details of treatments I received during my pregnancy, and information about how many children I have. I have also been told the document contains the personal information of around 150 patients.

"After speaking with someone who works within the NHS, I was informed that accessing and sending this type of data to a personal email account is both extremely difficult to do and considered a very serious breach of data protection rules.

"While the employee has reportedly stated that the information was taken for analytical purposes, the NHS has advised that they cannot say with complete certainty whether copies of the document still exist or whether it was shared elsewhere.

"I believe this raises significant concerns about patient confidentiality and data security.”

The woman added that the situation had made her very anxious that her private details were in the public domain.

It is understood that the personal details varied by individual, but included names, dates of birth, postcodes and information about their maternity care.

A spokesperson for NHS Forth Valley said: “An internal investigation is underway after a member of staff transferred a spreadsheet containing an extract of data from our maternity system to their personal email address.

"While the majority of information in the spreadsheet is unidentifiable, it contained some lines of data relating to a number of women who had accessed local maternity services.

"There is no evidence that the information has been shared any wider at this stage and the member of staff has also advised that they have now deleted the data.”

"The women involved have been contacted direct and a number of other relevant organisations, including the UK Information Commissioner, have also been informed.”

The spokesperson declined to reveal if the member of staff involved had been suspended or if any disciplinary action had taken place.

NHS Forth had said the matter had also been reported to Police Scotland but local officers had no knowledge of the incident.

An Information Commissioner’s Office spokesperson said: “We have received a report from NHS Forth Valley and are making enquiries.”

The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 states organisations must follow six basic data protection principles, including ensuring that details are “processed in a manner that ensures appropriate security”.