Breach details
| What |
Letters containing medical information were sent to the wrong address. |
| How much |
4 records. |
| When |
A period of 18 months up to November 2013. |
| Why |
Letters were sent out by temporary or bank staff who had not received relevant data protection training as such training was not required for temporary members of staff. Permanent staff were also not obliged to attend training as it was not enforced. In addition to this there were no policies or procedures in place to ensure the accuracy of addresses. |
Regulatory action
ActionUndertaking to comply with the seventh data protection principle.
| Regulator |
ICO |
| When |
21 November 2013. |
| Details |
Temporary or bank staff must be provided with data protection training before working with personal and sensitive personal data and all training is to be monitored and attendance enforced. Processes are also to be put in place to ensure documents are sent to the right address and practical guidance is to be communicated to all staff. |
Links
Follow Up
