Following the ‘unauthorised use of WhatsApp’ to share patient data, the independent body for upholding information rights across the UK has issued a formal reprimand to NHS Lanarkshire.

The Information Commissioner’s Office (ICO) found that staff in the health board used a WhatsApp group chat to share patients’ personal data over the course of two years.

Between April 2020 and April 2022, 26 NHS Lanarkshire staff members had access to a WhatsApp group chat where patient data – including names, phone numbers and addresses – was shared on more than 500 occasions.

NHS Lanarkshire will now have to put in place a number of improvements within the next six months.

While the group chat was created for communicating basic information at the start of the pandemic, WhatsApp was not approved by NHS Lanarkshire for processing patient data.

Yet, it was adopted by 26 NHS Lanarkshire staff without the organisation’s knowledge – with images, videos and screenshots including clinical information also shared.

Trudi Marshall, Nurse Director Health & Social Care North Lanarkshire, told healthandcare.scot:

“We have received a formal reprimand from the ICO for the use of WhatsApp by one of our community teams to exchange personal patient data during the pandemic.

“We recognise that the team took this approach as a substitute for communications that would have normally taken place in either a clinical or office setting, but was not possible at that time due to COVID restrictions.

“However, the use of Whatsapp was never intended for processing patient data.

“We offer our sincere apologies to anyone whose personal details were shared through this group.”

A non-staff member was also accidentally added to the group, meaning they too had access to personal information of patients.

Once the health board was made aware, it reported the incident to the ICO.

Last year’s revised approach to public sector enforcement from the ICO aims to encourage greater data protection compliance from public authorities to prevent harms before they occur.

John Edwards, UK Information Commissioner, said despite the huge pressure heightened during the pandemic, there is “no excuse” for letting data protection standards slip:

“Patient data is highly sensitive information that must be handled carefully and securely. When accessing healthcare and other vital services, people need to trust that their data is in safe hands.

“We appreciate that NHS Lanarkshire, like all healthcare providers, was under huge pressure during the pandemic but there is no excuse for letting data protection standards slip.

“Every healthcare organisation should look at this case as a lesson learned and consider their own policies when it comes to both messaging apps and processing information about patients. We will be following up with NHS Lanarkshire to ensure that patient data is not compromised again.”

The ICO found NHS Lanarkshire did not have in place the appropriate policies, clear guidance and processes when WhatsApp was made available to download.

For example, the health board did not undertake an assessment of the potential risk relating to sharing patient data in this way.

Alongside issuing a reprimand, the ICO has recommended that NHS Lanarkshire implement a ‘secure clinical image transfer system’ and review and amend its policies and procedures.

More widely, the body recommended a review of all organisation policies and procedures relevant to this incident and to amend where appropriate.

The board has also been instructed to consider the risks relating to personal data and to adopt risk assessment and mitigation stages in any approval process for new apps.

NHS Lanarkshire is expected to provide an update of actions taken to the ICO within six months of the reprimand being issued.

Trudi Marshall, Nurse Director Health & Social Care North Lanarkshire, added that changes are underway:

“We have already taken a number of steps including looking at alternative apps that can be introduced for the transfer and storage of images and videos within a care setting.

“This is being taken forward while considering the risks relating to the storage of any personal data.”

Read more: NHS Lanarkshire out of code black; Scotland reaches heart valve treatment milestone; Removal of mask wearing ‘dangerous'; New £10m fund for cancer treatment; Scots women at the forefront of medical sciences; Staff shortage concerns in latest MWC reviews

Sign up to our bulletin for key health & social care updates straight to your inbox and you can follow healthandcare.scot on Google News.