HSE fined €645k after old medical records found rotting, mouldy and covered in animal droppings

THE HSE HAS been fined a total of €645,000 by the Data Protection Commission (DPC) for storing paper records in disused buildings, where many were rotting, mouldy and contaminated with animal droppings. 

The DPC’s inquiry into 12 sites owned by the HSE was initially prompted by the discovery of patient records in two former psychiatric hospitals after people broke in and posted videos of them on social media in October and November 2023. 

The first two locations in which the documents were found – St Loman’s Hospital in Westmeath and St Conal’s Hospital in Donegal – are no longer in use. One is contaminated by asbestos and the other by mould.

Then in April 2024, the HSE itself notified the DPC of a similar discovery of documents, which was also posted on social media. 

The HSE told the DPC these were “old mental health” records. 

Advertisement

DPC officers then commenced investigations at 12 HSE properties, where more old records were found. 

“The DPC’s findings identified data protection failings concerning the physical conditions of HSE document storage facilities and the integrity of the documents held within those facilities,” the watchdog said. 

DPC’s deputy commissioner, Graham Doyle, said the inspections revealed “significant issues with documents damaged or effectively destroyed by mould, contaminated by animal droppings, covered in rubble or detritus, rotting due to the storage environment or water damaged”. 

He said storage areas had been discovered “in such profound disarray and neglect that the records contained within them could not be deemed to be filed in any organised or accessible manner”. 

“There were records stored in disused bathrooms and cubicles, a shipping container in a turf shed, rooms without functioning lighting or heating, as well as derelict buildings at a number of disparate locations,” Doyle said. 

The fact that the HSE was keeping records that should have been destroyed once their storage was no longer necessary “gives rise to an ongoing significant risk of unauthorised access to and disclosure of sensitive medical information by third parties,” he said. 

“There is also the risk of records not being available for other medical care or other legal or regulatory reasons.”