NHS Scotland health board rapped for sending images of patients to a WhatsApp group chat

A Scottish health board has been criticised by the UK’s Information Commissioner for sending images of patients and their personal data over WhatsApp, and for allowing non-staff to access the group chat.

One of Scotland’s largest health boards has issued a public apology after being reprimanded for sharing images of patients and personal data hundreds of times over a popular messaging network.

The Information Commissioner’s Office (ICO) has issued a reprimand to NHS Lanarkshire after they found 26 staff sent sensitive data to each other via the WhatsApp messaging app on more than 500 occasions.

A non-staff member was also added to the WhatsApp group in error, “resulting in the inappropriate disclosure of personal information to an unauthorised individual”.

Social media app WhatsApp, displayed on a mobile phone screen. A watchdog has reprimanded a health board after staff members shared patients’ personal data on WhatsApp hundreds of times. Picture: Yui Mok/PA Wire

The data, which was leaked between April 2020 and April last year, included patients’ names, phone numbers, addresses, images, videos, screenshots and clinical information.

While WhatsApp is approved for NHS staff for basic communication, it is not approved by the NHS for sharing sensitive data.

NHS Lanarkshire was made aware of the issue and reported the incident to the ICO, which conducted an investigation and concluded the organisation did not have the appropriate policies, clear guidance or processes in place when WhatsApp was made available to download.

This meant NHS Lanarkshire had no assessment of the potential risks relating to sharing patient data.

UK Information Commissioner John Edwards said patient data was “highly sensitive information that must be handled carefully and securely”.

“When accessing healthcare and other vital services, people need to trust that their data is in safe hands,” he said.

“We appreciate that NHS Lanarkshire, like all healthcare providers, was under huge pressure during the pandemic, but there is no excuse for letting data protection standards slip.

“Every healthcare organisation should look at this case as a lesson learned and consider their own policies when it comes to both messaging apps and processing information about patients. We will be following up with NHS Lanarkshire to ensure that patient data is not compromised again.”

The ICO has since recommended NHS Lanarkshire should take action to prevent future data breaches. The ICO suggested the health board should implement a secure clinical image transfer system for the storage of images and videos within a care setting.

The watchdog said NHS Lanarkshire should “consider the risks” in relation to personal data and ensure staff are “aware of their responsibilities to report personal data breaches internally without delay to the relevant team”.

The watchdog has also called for the health board to “ensure explicit communications, instructions or guidance are issued to employees on their data protection responsibilities when new apps are deployed”.

The ICO asked NHS Lanarkshire to provide an update of action taken within six months of the reprimand being issued.

Trudi Marshall, nurse director of health and social care at North Lanarkshire, said: “We have received a formal reprimand from the ICO for the use of WhatsApp by one of our community teams to exchange personal patient data during the pandemic.

“We recognise that the team took this approach as a substitute for communications that would have normally taken place in either a clinical or office setting, but was not possible at that time due to Covid restrictions. However, the use of WhatsApp was never intended for processing patient data.

“We offer our sincere apologies to anyone whose personal details were shared through this group. We have already taken a number of steps, including looking at alternative apps that can be introduced for the transfer and storage of images and videos within a care setting.

“This is being taken forward while considering the risks relating to the storage of any personal data.”

It is the second significant data breach involving NHS Lanarkshire in the past three years.

The health board confirmed in 2020 it had similarly written to the ICO after there were 414 data breaches between March 12 and May 25 of that year.

Gabe Docherty, the-then director of public health and health policy, said in a statement at the time: “We take incidents like this seriously and we have written to offer our sincere apologies to those affected.

“The first incident relating to 20 patients was reported to the Information Commissioner’s Office who acknowledged human error. The second incident involving 388 patients was an internal staff email which was immediately recalled and deleted.

“We have updated our processes to avoid similar incidents from occurring in future.”