Revealed: 2,500 patients' data was released in Oswestry orthopaedic hospital breach
Up to 2,500 patients had their data released without permission in a breach at Shropshire's orthopaedic hospital, it has been revealed.
Details of how patient data was released by Oswestry's Robert Jones and Agnes Hunt Orthopaedic Hospital emerged at a meeting of the hospital trust's directors yesterday.
It was confirmed that up to 2,500 people could be affected by the breach, which saw some patients' information given to a medical components manufacturer.
It has been revealed that the information included some patients' surnames and initials, hospital numbers, and clinical information – including clinical measurements.
Senior leaders at the hospital have pledged to contact every patient affected.
The hospital trust has been investigating since discovering in late April that some data of up to 2,500 patients taking part in a long-standing surveillance study may have been shared without their consent. It reported the matter to the Information Commissioner when it became aware.
An internal investigation has found that some information collected as part of usual treatment was shared with the medical component manufacturer as part of a surveillance study.
The study, which began in 2006, was set up to monitor the outcomes for patients of procedures using the components.
The investigation, which is still ongoing, has found that not all patients were aware their data was being used in the study.
Chief executive Mark Brandreth said: “This is not acceptable and we will be writing to those patients affected to apologise for processing data in this way. The trust takes the protection of its patients’ data extremely seriously and regrets this breach. A full investigation is under way to establish how it has occurred and ensure that measures are taken to prevent anything similar from happening in the future.
“It is a patient’s right to decide how their data is used and therefore it is important for the trust to be clear whether a patient is happy for their data to continue to be processed in this way or whether they wish to withdraw from the study.
“To that end, we will be writing to patients who may be affected to understand their wishes in the coming weeks. Once again I would wish to apologise to any patient affected.”
He said the data shared may have included the initial and surname of some patients, as well as their hospital number and limited extracts of clinical information relevant to the study, for example clinical measurements."
Mr Brandreth said: "No patient case notes have been shared."
Anyone concerned that they might be affected can contact the hospital’s Patient Advice and Liaison Service (PALS) on 01691 404606 or by e-mailing PALS.office@rjah.nhs.uk.
