Patients have expressed their anger after private details were leaked in a “deeply concerning” data breach at a Fife medical practice.
Invoices containing the names, addresses and dates of birth of some patients registered at Tayview Medical Practice were emailed to an individual patient by mistake.
The documents also included details of private work that the patients at the surgeries in Tayport and Newport-on-Tay had paid for.
Emails seen by The Courier suggest about two years’ worth of patient invoices were leaked by mistake on September 20.
However, in a letter sent to patients just a few days ago, business manager David Ramsay said he had only been made aware of the breach on November 7.
Information Commissioner’s Office investigates Tayview practice data breach
A probe is under way at the Information Commissioner’s Office, which must be informed of a breach within 72 hours of it taking place.
It has not been confirmed when the ICO was told about the breach or how many patients were affected.
As of October, more than 9,000 people were registered at Tayview.
The man who received the original email containing the leaked documents told The Courier there was a large amount of information attached.
The man, who has now deleted the email, said: “We knew immediately when we were emailed a large amount of files that there had been some sort of mistake.
‘There were hundreds of files, if not thousands’
“It was difficult to know how many patient files were included as neither my wife nor I opened them but there were hundreds, if not thousands.
“The practice was repeatedly informed by us of the breach so I’m surprised that the practice is only informing people now.”
One woman whose details were leaked in the breach described it as “deeply concerning”.
The patient, who asked not to be named, said: “I received the letter without warning on Saturday and at first, I thought it was some sort of scam.
“Then I saw on social media that scores of other patients had also had their private records and personal information compromised.
“People are rightly very angry at how our personal and medical information could be breached.
“We want to know how and why this could have happened.
“It’s deeply concerning.”
Tayview charges for a range of private work, such as medicals for firearms applications, helping patients to register for power of attorney and supplying reports to insurers and solicitors.
Tayview has ‘discussion’ with staff member involved in data leak
Mr Ramsay’s letter to affected patients said: “An invoice containing your full name and address was mistakenly emailed to another patient in error.
“Information relating to the reason for the invoice was also viewable on the invoice.
“The invoice related to a period where private work was either requested from you or an external agency (e.g. an insurance company on your behalf).”
He said the affected patients should not have to take any steps to protect themselves and that an internal investigation was due to be concluded by November 24.
Tayview boss issues ‘unreserved apology’ for information leak
Mr Ramsay also outlined steps being taken by the practice to avoid a repeat, including “discussion” with the staff member involved.
He added: “We fully apologise unreservedly that this breach of confidentiality has occurred and I can appreciate this breach may cause you some concern.
“I do hope the above addresses some of those concerns in relation to how the practice is proceeding and would like to reassure you that we have taken the breach of your confidential information extremely seriously.”
When The Courier contacted Tayview Medical Practice, we were told Mr Ramsay was unavailable as he was on leave, and that no one else was able to comment.
An ICO spokesperson said: “People have the right to expect that organisations will handle their personal information securely and responsibly.
“If an individual has concerns about how their data has been handled, they should raise it with the organisation first, then report them to us if they are not satisfied with the response.
“Tayview Medical Practice has made us aware of an incident and we are assessing the information provided.”
It comes as the Tayport surgery has been forced to close eight times since October 24 due to “critical staffing levels”.
Earlier this year, NHS Tayside was involved in two separate data breaches.
Staff were said to be “raging” when their details were leaked to another department in August, and then in September, it emerged paperwork for hundreds of patients had gone missing.
Conversation