The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

Case Study 1

Drogheda Hospital- investigation into a consultant's practice- patients felt consent was necessary- balance to be struck with concerns for public health issues overall

I received many complaints from former patients of a Drogheda hospital in relation to the manner in which an investigation was carried out by a health board into the conduct of a consultant's practice. They complained that in the course of its investigation, the health board had sent copies of patients' records and charts to a UK based healthcare risk management group and to an Irish review group without the consent of the individuals involved in 1998 and subsequently.

When I began to investigate the matter, I established that the data that had been disclosed by the Health Board prior to1 July, 2003 was manual data, consisting of patient files, theatre files, etc. While the Data Protection Act, 1988 only applied to personal data on computer the Data Protection (Amendment) Act, 2003 applies to manual data from 1 July, 2003.Whilst manual data, therefore, was involved, and was not subject to the remit of my Office as the manual data in question was referred in 1998, nevertheless, given the major issue involved, the matter was given full consideration as if the principles of both Acts applied.

The background to these complaints was that in October, 1998 the Health Board was made aware of serious concerns in relation to the management of patients under the care of a Consultant Obstetrician/ Gynaecologist, as a result of which a preliminary assessment was carried out in relation to the perceived concerns regarding his clinical practice. The records of 42 patients were involved and to ensure patient privacy and confidentiality, patients were numbered consecutively and this numbering was used in the management of all subsequent classifications in the review process.

Initially the records of 3 patients were sent to the UK based company for risk assessment review. Consultation was then undertaken by the Health Board with the Chairman of the Institute of Obstetrician and Gynaecologists in Ireland, who indicated that the Institute would assist the Board in order to conduct a review. The Board stated that it was their intention to deal with the alleged serious concerns regarding the Consultant and his practice in a confidential and sensitive process, having regard to the Board's statutory duty of care and service management to patients availing of services within its area. The Review was carried out by the Institute at the request of the Health Board, and consisted of three independent Obstetrician Gynaecologists. The Terms of Reference included a request to assess and consider the nature and merit of the concerns of the Health Board.

The Health Board maintained that it had a duty of care to patients within the Health Board area and when it was appraised of serious concerns relating to patient care, immediate legal and medical advice was sought and that it was in this regard that charts were provided in a confidential manner to the Review Group following consultation with the Institute of Obstetricians and Gynaecologists. It also stated that at this stage the well being of patients and the wider population was the primary concern. The Health Board set up help lines and counselling services, following the significant media coverage of the concerns in December, 1998 regarding the consultant's practice. Following receipt of the Review Group's Report in April1999, the help-line was re-activated and direct contact was made with the General Practitioners of patients involved by way of letter and telephone, who were asked to advise patients directly about the report and the options available to them.

The general principle of the Data Protection Acts is that personal data should only be processed and disclosed to other parties with the patient's consent unless one of the provisions of section 8, which lift the restrictions on disclosure in limited and defined circumstances, apply.

Section 8(b) provides that -

"8.-Any restrictions in this Act on the processing of personal data do not apply if the processing is -

((b) required for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other moneys owed or payable to the State, a local authority or a health board, in any case in which the application of those restrictions would be likely to prejudice any of the matters aforesaid..."

while section 8(d) provides that -

"8- Any restrictions in this Act on the processing of personal data do not apply if the processing is-

(d) required urgently to prevent injury or other damage to the health of a person or serious loss of or damage to property."

Section 8 therefore recognises that privacy rights are in no sense absolute and must constantly be balanced against other competing interests including society's right to be made aware of particular information.

The matter which had to be considered by me, therefore, in terms of the Data Protection Acts, was whether the Board could rely on any of the provisions of section 8 as a basis for the referral of case files to the UK company and subsequently to the Enquiry by the Institute of Obstetricians and Gynaecologists, without the consent of the patients involved.

In routine referrals anonymised information should only be disclosed; charts etc might not need to be forwarded and indeed prior patient consent should be sought. However, in a case such as this when a serious matter, with implications for the health and welfare of past patients and indeed possible dangers for current and future patients, was brought to its attention, I deemed that the Board had a duty to fully establish all of the facts using whatever expert resources were necessary and indeed in a speedy and urgent manner. I considered that the Board were justified in disclosing the files in order to protect the health of those who had had the procedures carried out by the consultant and also so that necessary steps could be identified to avoid inappropriate procedures in the future. Having regard to the serious and far-reaching public health issues and circumstances involved, I considered that the Board were justified in making the disclosures under section 8(b) and section 8(d) of the Acts.

Furthermore, I considered that the disclosure by the Board was a compatible disclosure within the meaning of section 2 of the Acts. Section 2 (1) (c) (ii) provides that "data shall not be further processed in a manner incompatible with that purpose or those purposes" (for which it is held). I considered that the disclosure of patient data for the limited purpose of practice review in the wider interest of public health and, subject to confidentiality and privacy safeguards, was consistent with the purpose for which personal data was held by a healthcare provider. However, while names of patients were also included in the charts supplied to the reviewing bodies it would have been prudent, if it were feasible, given the urgency and importance of the investigation, to delete all references to patients so that only anonymised information was released.

I deeply appreciate and I am glad that the matter was brought to my attention by concerned and reasonable patients as it raised serious matters in the healthcare area regarding data protection.