Data breaches and indemnity

Indemnity issues surrounding data breaches can be complex and it is important that practices are aware of the requirements. Dr Dawn McGuire and Dr Ian Lavelle, Medico-Legal Consultants at Medical Protection, look at some cases and explain more.

Claims arising from data or confidentiality breaches are not uncommon. The practice may be pursued for these alleged breaches, whether within or outside healthcare provision. 

For example, Medical Protection has received claims after medical information or test results have been divulged to a patient’s relative or representative without the patient’s consent. 

Claims have also been reported to us following a practice employee accidentally sending medical information to the wrong recipient or address, losing medical records in their care, and leaving medical records in a public place. 

Another case centred around a member of the practice team accessing a patient’s medical records without valid reason. 

Key points 

It is vital that the whole practice team is familiar with data protection laws, confidentiality and information security, and are adequately trained. The Data Protection Commission provides a useful guide to data protection for organisations and employees who have day-to-day responsibility for data protection (https://www.dataprotection.ie/en/organisations). 

Claims or monetary penalties arising from data loss or data breaches fall outside of healthcare indemnity and is therefore outside the scope for Medical Protection assistance. 

Healthcare organisations like GP practices need to ensure adequate protection is in place for these claims. The practice manager can explore adequate indemnity protection with a public liability insurer or other appropriate insurers, for example employers’ liability or directors’ liability insurances. 

The practice may be pursued for these alleged breaches, whether within or outside healthcare provision