ICO reprimands NHS Lanarkshire for sharing patient data via WhatsApp

The Information Commissioner’s Office (ICO) has issued a reprimand to NHS Lanarkshire, following the unauthorised use of WhatsApp by staff to share patients’ personal data over a two-year period.

Between April 2020 and April 2022, 26 staff at NHS Lanarkshire had access to a WhatsApp group where patient data was entered on more than 500 occasions, including names, phone numbers and addresses. Members of the group also shared images, videos and screenshots, which included clinical information.

WhatsApp was made available for communicating basic information only at the start of the pandemic, but was not approved by NHS Lanarkshire for processing patient data and was adopted by staff without the organisation’s knowledge.

A non-staff member was also added to the WhatsApp group in error, resulting in the inappropriate disclosure of personal information to an unauthorised individual. Once NHS Lanarkshire became aware, it reported the incident to the ICO.

Trudi Marshall, nurse director health and social care at North Lanarkshire, said: “We have received a formal reprimand from the ICO for the use of WhatsApp by one of our community teams to exchange personal patient data during the pandemic.

“We recognise that the team took this approach as a substitute for communications that would have normally taken place in either a clinical or office setting but was not possible at that time due to Covid restrictions. However, the use of WhatsApp was never intended for processing patient data.

“We offer our sincere apologies to anyone whose personal details were shared through this group.

“We have already taken a number of steps including looking at alternative apps that can be introduced for the transfer and storage of images and videos within a care setting. This is being taken forward while considering the risks relating to the storage of any personal data.”

The ICO’s investigation concluded that NHS Lanarkshire did not have the appropriate policies, clear guidance and processes in place when WhatsApp was made available to download. For example there was no assessment of the potential risks relating to sharing patient data in this way.

Recommendations

The ICO recommended that NHS Lanarkshire should take action to ensure their compliance with data protection law, including:

• Consider implementing a secure clinical image transfer system, as part of NHS Lanarkshire’s exploration regarding the storage of images and videos within a care setting.
• Before deploying new apps, consider the risks relating to personal data and include the requirement to assess and mitigate these risks in any approval process.
• Ensure explicit communications, instructions or guidance are issued to employees on their data protection responsibilities when new apps are deployed.
• Review all organisational policies and procedures relevant to this incident and amend where appropriate.
• Ensure all staff are aware of their responsibilities to report personal data breaches internally without delay to the relevant team.

John Edwards, UK information commissioner, said: “Patient data is highly sensitive information that must be handled carefully and securely. When accessing healthcare and other vital services, people need to trust that their data is in safe hands.

“We appreciate that NHS Lanarkshire, like all healthcare providers, was under huge pressure during the pandemic but there is no excuse for letting data protection standards slip.

“Every healthcare organisation should look at this case as a lesson learned and consider their own policies when it comes to both messaging apps and processing information about patients. We will be following up with NHS Lanarkshire to ensure that patient data is not compromised again.”

The ICO has asked NHS Lanarkshire to provide an update of actions taken within six months of the reprimand being issued.

WhatsApp is not the first platform involving the sharing of NHS patient data. A few weeks ago, we reported that NHS England was investigating the reported transfer of private details of patient information from 20 NHS trusts to Facebook without consent.