The Information Commissioner's Office has served the first monetary penalty against the NHS for a serious breach of the Data Protection Act.
The announcement comes within days of the Information Commissioner saying he would like to extend the ICO's compulsory audit powers to the NHS at Infosecurity Europe 2012 in London.
Most of the 14 monetary penalties imposed so far have involved local councils, with the highest to date being £140,000 imposed against Midlothian Council in January.
The Aneurin Bevan Health Board (ABHB) in Wales was served with a penalty of £70,000 for sending a report containing explicit details relating to a patient’s health to the wrong person.
The error occurred in March last year when a consultant emailed a letter to a secretary for formatting, but did not include enough information for the secretary to identify the correct patient.
The doctor also misspelt the name of the patient at one point, which led to the report being sent to a former patient with a very similar name.
The ICO’s investigation found that neither member of staff had received data protection training and that the organisation did not have adequate checks in place to ensure that personal information was sent to the correct person.
“Aneurin Bevan Health Board failed to have suitable checks in place to keep the sensitive information they handled secure," said Stephen Eckersley, the ICO’s head of enforcement.
"This case could have been extremely distressing to the individual and their family and may have been prevented if the information had been checked prior to it being sent," he said.
Eckersley said the Health Board has signed an undertaking to taking action to address the problems highlighted by the ICO.
"However, organisations across the health service must stand up and take notice of this decision if they want to avoid future enforcement action from the ICO," he said.
The undertaking signed by ABHB includes ensuring that all staff are made aware of and trained on the organisation’s policies on storage and use of personal data, that there is appropriate and regular monitoring of compliance with policies on data protection and IT security, and that new checking processes are introduced across all sites to confirm a patient’s identity before personal information is sent out.