Group emails to patients of NHS Highland’s sexual health department have stopped indefinitely after a shocking data breach exposed confidential names and email addresses of 37 people with HIV.
An internal review has also revealed “an outstanding concern that the information held in the email could still be shared elsewhere” as it was now in cyberspace and “not within NHS Highland control”.
One of the patients concerned, a man in his 40s living in the region, has described the “external adverse event review” by senior managers as a “whitewash”.
The man, who wishes to remain anonymous, is preparing to sue the health authority for the breach of confidentiality.
The data breach happened in June and identified dozens of people with HIV across the region to others with the illness.
The blunder occurred after an email was distributed by NHS Highland to invite patients to a support group run by Raigmore Hospital’s sexual health service.
But it failed to conceal the personal details of patients, revealing these to fellow recipients of the email.
A recall of the email also failed to rectify the problem, the probe found.
The review stated: “Whilst the administrator [responsible] was familiar with NHS mail in general, they had only sent a blind carbon copy email once previously and had received no training on how to do it.
“Sending group emails was not a common request, particularly not blind copy.
“Recalling an email is unreliable, even for an experienced operator, and the team were mistaken in their belief that their attempt to recall had been effective.”
The review added: “NHS Highland is looking to move to another email platform in the future.
“The sexual health department no longer sends group emails to patients. Other departments may be using group patient emails and they need to be made aware of the potential issues surrounding this.
“NHS Highland needs to investigate other ways for getting communication to patient groups in a compliant and safe way.”
At the time of the data breach the health authority apologised for the blunder and informed the national independent watchdog, the Information Commissioner’s Office, and the Scottish Government.
First Minister Nicola Sturgeon admitted in the Scottish Parliament to “failings” by NHS Highland.
