The HSE has been fined €645,000 over serious data protection failures involving the storage of sensitive medical records.
An investigation by the Data Protection Commission (DPC) uncovered documents damaged by mould and water, contaminated by animal droppings and left among rubble and other debris.
Inspectors also found records being kept in disused bathrooms and cubicles, a shipping container in a turf shed and derelict buildings.
The inquiry began following two data breaches reported in 2023 involving former psychiatric hospitals in Westmeath and Donegal.
People gained unauthorised access to records at St. Loman’s Hospital in Mullingar and St. Conal’s Hospital in Letterkenny, with videos posted on social media showing medical documents being stored at both locations.
The HSE later informed the DPC of further unauthorised access to the basement of St. Loman’s, where additional records were being stored.
The watchdog carried out inspections at 12 locations around the country to establish whether the problems extended beyond the two hospitals.
Deputy Commissioner Graham Doyle said some storage areas were in such a state of ‘disarray and neglect’ that records could not be considered organised or accessible.
The DPC found the HSE had failed to provide appropriate security for personal data and had retained some information for longer than necessary.
It also found failures relating to the notification of breaches and communicating them to affected individuals.
The HSE has been reprimanded and ordered to carry out a complete audit of facilities where paper records are stored.
Records must be removed from locations which are not fit for purpose, while documents which no longer need to be retained must be safely destroyed.
The health service must also introduce systems to track the location of paper records and regularly assess its storage facilities.
The €645,000 penalty comprises fines of €300,000 for security failures, €300,000 over storage limitation breaches, €30,000 relating to breach notifications and €15,000 for failures to inform affected individuals.
The DPC said previous similar infringements by the HSE were considered an aggravating factor when determining the penalties.
