NHS trust mounts legal challenge to information commissioner's fine
An NHS trust has instructed lawyers to challenge a £90,000 fine slapped on it by the Information Commissioner's Office (ICO) for breaking data laws.
Central London Community Healthcare (CLCH) NHS Trust was fined after 59 patients' records were faxed to the wrong person time 59 times over a three-month period, between March and June last year.
The trust is appealing against the fine saying that it was compelled to challenge the decision as the ICO had acted incorrectly on a matter of law. While "regretting the error", the trust says the fine should be rescinded as it reported the breach itself and has taken measures to prevent it from occurring again.
The ICO said the CLCH did not have sufficient checks in place and the documents should not have been sent to a member of the public.
The recipient of the faxes shredded the files, which should have been sent by the Pembridge Palliative Care Unit to St John's Hospice.
The lists contained data on patients, including medical diagnoses and information on their domestic situations and resuscitation instructions.
The ICO ruled that CLCH did not have sufficient checks in place to ensure that sensitive information sent by fax was delivered to the correct recipient. Head of enforcement Stephen Eckersley said: "Patients rely on the NHS to keep their details safe.In this case Central London Community Healthcare NHS Trust failed to keep their patients' sensitive information secure.
"The fact that this information was sent to the wrong recipient for three months without anyone noticing makes this case all the more worrying."
At the time of the security breach the trust had not given any consideration to a possible alternative to the use of fax transmission such as secure email, the ICO said. The trust says it is now planning to switch to email.
The CLCH is the second NHS body to be fined for breaching data laws, in April the Aneurin Bevan Health Board in Wales was fined £70,000 after it sent sensitive data to the wrong patient.