London clinic overhauls email procedure following patient data leak
London clinic 56 Dean Street has issued an update following a human error last week that resulted in 780 patients’ names and email addresses being exposed.
The NHS Trust-run organisation admitted that the inadvertent data breach, which occurred when the sender failed to input the recipients in ‘BCC’ on the OptionE online service, was “completely unacceptable”; while one affected HIV patient told The Guardian: “In the wrong hands, this list could be dynamite”.
Writing today (September 8), the clinic has issued a public update, saying firstly that all group emails have been suspended: “From now on the OptionE newsletter will be hosted on this webpage. A link to it will be included in each OptionE result email. We will not send it by group email again.”
Other steps include the deletion of the clinic’s Microsoft Outlook contacts list, making further group emails impossible; and a new rule whereby any outbound emails will be held on the system for two hours before being sent, allowing time for errors to be spotted.
Legal advice sent on by lawyers is also shared, indicating that anybody who shared the list of patients and their contact details would be breaking the law. It states: “It is a criminal offence under the Data Protection Act to deliberately publish/further disclose sensitive personal data without a legally legitimate reason for doing so. To this end, any individual who chooses to further distribute the data in this way runs the risk of prosecution.”
Two formal investigations are underway: one by the NHS Information Commission (ICO) and another by Chelsea and Westminster. It is stressed: “The people running the investigation are from a separate part of our organisation and are not linked to the HIV/Sexual Health service.
“We promise we will act on the outcomes of these investigations. The findings and recommendations will be made public.”
Writing for Attitude, last week writer Patrick Cash urged the LGBT+ community to rally round the clinic in the aftermath of the error.