The health secretary, Jeremy Hunt, has ordered an inquiry into how the NHS handles confidential medical information after the “completely unacceptable” breach of the privacy of hundreds of HIV patients.
The 56 Dean Street clinic in London apologised on Wednesday after sending a newsletter on Tuesday which disclosed the names and email addresses of about 780 recipients. The newsletter is intended for people using its HIV and other sexual health services, and gives details of treatments and support.
Hunt said the Care Quality Commission would conduct what he called a thorough and independent review of the effectiveness of existing data security measures in the NHS and recommend changes. It will also look into how the NHS can beef up its security against cyber-attacks and reduce the risk of staff inadvertently disclosing sensitive information.
Hunt said the inquiry was vital to ensure patients could be confident that the health service will properly safeguard details of their health and treatment records. “The truth is that we will throw this all away if we lose the public’s trust in our ability to look after their personal data securely,” he told delegates at NHS England’s annual conference in Manchester.
“Nothing matters more to us than our own health, but we must also understand that for NHS patients nothing matters more to them than confidence that the NHS will look after their own personal medical data with the highest standards of security.
“The truth is the NHS have not won the public’s trust in our ability to do this as today’s completely unacceptable data breach at the Dean Street surgery demonstrates.”
The clinic, which is run by the Chelsea and Westminster NHS trust, apologised shortly after sending the email and on Wednesday pledged to investigate how the breach had occurred.
Britain’s data protection watchdog is also likely to launch an investigation into the privacy breach, thought to be one of the biggest of its kind. The newsletter was sent to about 780 patients who had signed up to the clinic’s Option E service, which allows people to book appointments and receive test results by email. Instead of hiding the personal details of those on its recipient list, it included their full names and email addresses.
One HIV patient whose details were exposed by the email said the NHS had “no way of controlling who sees this information now and, in the wrong hands, this list could be dynamite”.
He told the Guardian: “I have been a patient at 56 Dean Street since moving to London five years ago and I have always trusted them with my information. Option E is a service set up for patients who are stable and on long-term HIV treatment. It is designed to make life easier, so your results etc are sent via email.
“I find it impossible to believe that in this day and age this can happen. I was able to scroll down the list and identify the names of a number of people who I knew, some of whom I was unaware of their status.”
Rob Sherrard, an HIV patient who has attended 56 Dean Street for two and a half years, said it would be “tragic if this incident overshadowed all the amazing work they do” at the clinic.
“The level of care [and] service I’ve received has been second to none,” Sherrard said. “I’ve always been treated like an individual and every member of staff I’ve dealt with has at some point gone the extra mile for me. It’s human error and could have happened to anyone. I hope the individual responsible will be forgiven.”
Another of the clinic’s patients told the Guardian he was shocked by the breach and worried that the list of all those affected might end up on the internet. “I have always been extremely careful about who I share my HIV-positive status with as there is still a lot of stigma and ignorance about the subject. I haven’t told my family and a lot of my very close friends still don’t know and now strangers and possibly people who I may have met on a casual basis might be able to find out that I am positive,” said the man, a 31-year-old event manager.
“I am a bit paranoid that somehow the list might be shared or end up published on the internet somewhere. I know that is a bit unlikely but it still terrifies me. I am worried that if there is legal action [for breach of privacy] my anonymity will be further compromised as well.
“It’s causing me a great deal of stress. I don’t know how something like this can happen in a sexual health and HIV clinic. Of all the health services, you would think that one that deals with these sensitive matters would have the most security when it comes to confidentiality.”
Elliot Herman, 38, from London, said the email contained the names of friends who had never disclosed their HIV status to him before. “It’s not difficult to put those names into Facebook and bring up their profiles and personal details,” he said. “If my details were on that list I would feel angry and disappointed at the clinic for having such a shit system that this can happen.”
Within hours of the breach, the clinic set up a helpline and sent patients an email apology from Dr Alan McOwan, Chelsea and Westminster hospital NHS trust’s director for sexual health.
It said: “I’m writing to apologise to you. This morning at around 11.30am we sent you the latest edition of Option E newsletter. This is normally sent to individuals on an individual basis, but unfortunately we sent out today’s email to a group of email addresses. We apologise for this error.
“We recalled/deleted the email as soon as we realised what had happened. If it is still in your inbox please delete it immediately. Clearly this is completely unacceptable. We are urgently investigating how this has happened and I promise you that we will take steps to ensure it never happens again. We will send you the outcome of the investigation.”
A 56 Dean Street spokesman said the breach was down to a “human mistake” and that the employee responsible was distraught. The clinic later said that not all the recipients of the email were necessarily HIV-positive.
The information commissioner’s office (ICO) said it was aware of the incident and was making inquiries. The privacy watchdog can levy fines of up to £500,000 for significant data breaches.
We are aware of the incident regarding the 56 Dean Street clinic and are making enquiries
— ICO (@ICOnews) September 2, 2015
Herman, who was not on the email list but whose friends’ HIV status was exposed, has complained about the breach to the NHS patient advice and liaison service.
“This is serious breach of data protection. There are several names I recognise from the list, and while I am of course being discreet, I am not sure I trust every other person on the list to do the same,” he wrote in the complaint.
“I feel bad making this complaint, because I have a great deal of respect and admiration for the excellent service provided by the clinic and my own doctor, Alan McOwan, who has always provided superb clinical care. I have never had cause to complain in the past. However, I feel this is important enough to bring to official attention.”
56 Dean Street, based in Soho, central London, bills itself as Europe’s busiest sexual health, contraception and HIV care clinic. In 2011 the clinic set the world record for the most HIV tests performed in one location, at G-A-Y bar in Soho on World Aids Day.
Last year it claimed to be the first clinic in the world to have an on-site Infinity machine, allowing it to give HIV test results within six hours.
The clinic has set up a helpline for patients affected by the breach on 020 3315 9555 or 020 3315 9594.
- Were your details exposed on the 56 Dean Street email? If so, you can contact us via the form below. We will not publish your personal details if you don’t want us to.