A data breach at of the leading sexual health clinics in Britain has revealed the names and contact details of almost 800 HIV positive patients.
The 56 Dean Street clinic in London, part of the Chelsea and Westminster NHS Trust, accidentally disclosed the information when an email newsletter for the clinic’s Option E online service was sent out en masse, rather than to individual recipients.
Names and email addresses of the 780 recipients of the list were not hidden in the email. The incident represents a massive breach of patient privacy.
The privacy breach is suspected to be one of the biggest of its kind and is already being investigated by the Information Commissioner’s Office (ICO).
“We are aware of an incident regarding the 56 Dean Street clinic and are making enquiries” an ICO spokesperson told Computing.
The clinic has already stated that it is examining how the breach occurred, with a “human mistake” thought to be the cause.
56 Dean Street clinic has apologised to patients affected by the breach and set up a helpline to aid those who have had their privacy breached.
“I’m writing to apologise to you. This morning at around 11.30am at we sent you the latest edition of OptionE newsletter,” Dr Alan McOwan, Chelsea and Westminster hospital NHS Trust’s director for sexual health wrote in an email to patients.
“This is normally sent to individuals on an individual basis but unfortunately we sent out today’s email to a group of email addresses. We apologise for this error,” he said.
“We recalled/deleted the email as soon as we realised what had happened,” Dr McOwan continued, adding “If it is still in your inbox please delete it immediately.”
“Clearly this is completely unacceptable. We are urgently investigating how this has happened and I promise you that we will take steps to ensure it never happens again. We will send you the outcome of the investigation,” he concluded.
Complaints about the breach have already been made to the NHS patient advice and liaison service on behalf of those who’ve been affected.
“This is serious breach of data protection. There are several names I recognise from the list, and while I am of course being discreet, I am not sure I trust every other person on the list to do the same,” Elliot Herman from London wrote in an email of complaint seen by The Guardian.
“I feel bad making this complaint, because I have a great deal of respect and admiration for the excellent service provided by the clinic and my own doctor, Alan McOwan, who has always provided superb clinical care. I have never had cause to complain in the past. However, I feel this is important enough to bring to official attention,” he added.