This site is intended for health professionals only

Recycled NHS records used in art festival ‘breached data protection’, says CCG

Recycled medical records used as part of a festival’s art sculpture in a town centre ‘breached data protection’ rules according to a CCG. 

The records were visible to festival-goers last weekend, according to reports in The Sun, and included sensitive patient information.

NHS Milton Keynes CCG said it is concerned the records – used as a ballast to support a four-storey art structure outside a Milton Keynes shopping centre – are ‘still in situ’ and it is working with council colleagues to remove and destroy them as soon as possible.

A spokesperson for the CCG said: ‘NHS Milton Keynes CCG is extremely concerned about this breach of data protection. We are working with council colleagues to ensure they take remedial action and remove and destroy all patient information in an appropriate way, as soon as possible.

‘We are concerned that the data is still in situ. As the data includes confidential patient information, we have also reported the breach to the Information Commissioner’s Office.’

Milton Keynes Council said it was ‘appalled’ that the records had been used in a visible display, but that they were immediately covered once it was recognised.

A spokesperson for Milton Keynes Council said: ‘We were appalled to learn personal details were visible in a display of recycled paper. We immediately covered the bales and are arranging for their removal. We’ve asked the supplier of the bales to investigate, as it falls far short of our expectations.’

The company who supplied the paper, CS Recycling, said it was meant to come to them shredded, and they could not comment on the origins of the contents.

A spokesperson said: ‘To our knowledge, the bales were 100% shredded paper and labels.

‘We bought this shredded paper in bales as waste paper, not “paper for shredding”, which is a key difference.

‘CS Recycling was solely organising the recycling of the bales not the destruction of the data contained within the bales.’

They added: ‘The liability for the data contained within the bales, therefore, falls with the company at the beginning of the supply chain who would have been commissioned to destroy the data on the documents through shredding.’

The company that brokered the material between the shredding contractor and CS Recycling, Ecogen, said despite reports in the media to the contrary, the paper did seem to be shredded. 

A spokesperson said: ‘In our industry, once paper has been shredded it is no longer a data risk but classed as waste paper so there was no reason for Ecogen to ask for the source. Ecogen never physically handled this material but I do believe this paper was shredded by the shredding contractor both from pictures we received prior to loading and pictures we have seen since in the press.’

Capita, which deals with NHS patient records and – according to its website – handles the ‘lifecycle’ of documents including storage and destruction, said this case had ‘nothing to do with Capita or PCSE’. 

It follows the news that the BMA were exploring legal action against Capita after it wrongly archived 160,000 patient records