Medical records breach may affect thousands

AN investigation into how sensitive medical records were illegally accessed in the Philippines has spread to 60 more Irish hospitals and individual doctors — potentially compromising the private data of thousands of patients.

The Irish Examiner understands that the Data Protection Commissioner is writing to all Irish health clients of the UScribe online transcription firm over fears that their patients have been subject to significant security breaches, similar to those highlighted at Tallaght Hospital.

This will potentially leave thousands of patients across Ireland exposed to the risk of fraud as documents containing names, dates of birth, addresses, contact information, medical conditions and histories may be involved.

The letters, which are due to be sent today, were drawn up after local police in the Philippines seized the contents of offices owned by a firm which received the documents for transcription from UScribe during a pre-planned, court-ordered raid.

The strong-hand measure — which is not directly connected to the letters being sent out — was part of an ongoing investigation into how Tallaght Hospital patient files were obtained by a third party after being sent away by the facility to be transcribed.

The records taken during the raid are understood to involve not just Tallaght Hospital documents.

The raid took place with the permission of the Data Protection Commissioner in Ireland, the National Bureau of Investigations in the Philippines and senior representatives of Tallaght Hospital, who travelled to the southeast Asian country as part of inquiries.

To date, the Data Protection Commissioner does not have any official evidence to suggest the scandal at Tallaght Hospital was repeated elsewhere.

However, those involved in the major international investigation believe it would be “highly unusual” for the information leak to be confined to just one hospital at a time when records for 60 other health service clients were also being transcribed by UScribe.

It is understood that a number of the 60 hospitals and doctors whose patient files may be involved, and which either were or are clients of UScribe, are in the HSE’s public system.

This is despite the fact that in recent weeks the HSE has consistently said that it is not aware that any of its hospitals have a relationship with the private company.

The move came after the Irish Examiner revealed last week that, despite initial claims the scandal was confined solely to Tallaght, facilities including the Mercy University Hospital in Cork, Galway University Hospital and Peamount Hospital in Dublin city could also have been affected.

The Mercy has employed UScribe to transcribe records since 2005, Galway University Hospital used it for six months during a cardiology pilot scheme in 2004 and Peamount has been a client of the firm since 2005 — similar periods to Tallaght Hospital.

These three hospitals have not reported concerns about patient record security.

* Data Protection Commissioner email: [e-mail]