The lawyer investigating claims on behalf of a number of patients whose identities were mistakenly revealed last week by an HIV clinic has said that it could face hundreds of legal claims.
The 56 Dean Street clinic in London’s Soho sent a newsletter last Tuesday to around 780 patients who were copied into the “To” section of the email, rather than anonymously via the “bcc” address bar. This meant that, instead of hiding the personal details of those on its recipient list, it included their full names and email addresses. A spokesman for the clinic acknowledged that the mistake was caused by human error. The Information Commissioner’s Office is making inquiries.
The health secretary, Jeremy Hunt, warned that the error threatened to damage “the public’s trust in our ability to look after their personal data securely”. He said: “If we are going to win that trust, we need to strengthen the independent oversight of data security within the NHS to a level that we don’t have at the moment.”
Now Sean Humber, head of the human rights team at law firm Leigh Day, who has been instructed by several of those affected, says that the insurers covering the clinic could be liable for compensation claims, with each costing many thousands of pounds.
“This extremely unfortunate disclosure of sensitive medical information is clearly unlawful,” Humber said. “It is a breach of the duty of confidence owed by the clinic to each of its patients – almost certainly a breach of the Data Protection Act by the clinic – and would also seem to represent a breach of the patients’ human rights.”
Humber, who has brought claims on behalf of many patients relating to the unauthorised disclosure of confidential medical information, said the clinic’s “number one priority” must now be to limit the wider disclosure of the released information. “It must also ensure that those affected receive the necessary support during this difficult time,” Humber said. “It is inevitable that following this breach the clinic will be faced with very many claims resulting from the disclosure of such sensitive information.”
In an email apology sent soon after the newsletter’s distribution, Alan McOwan, Chelsea and Westminster hospital NHS foundation trust’s director for sexual health, described the data breach as completely unacceptable. McOwan wrote :“I’m writing to apologise to you. This morning at around 11.30am we sent you the latest edition of OptionE newsletter. This is normally sent to individuals on an individual basis, but unfortunately we sent out today’s email to a group of email addresses.”
McOwan said that the email was recalled and deleted as soon as the error was uncovered. “We are urgently investigating how this has happened and I promise you that we will take steps to ensure it never happens again.”