Thurles Information

We learned last week that the Data Protection Commission (DPC) has fined the HSE €645,000, following serious failures in the care of confidential medical records.

The investigation began after two data breaches were reported in 2023. People had gained unauthorised access to paper medical records stored in the disused St Loman’s psychiatric hospital in Mullingar and St Conal’s Hospital in Letterkenny.
Videos of the records were subsequently posted on social media.

When inspectors examined 12 HSE storage sites, they found records in appalling conditions. Documents were stored in disused bathrooms, cubicles, a shipping container inside a turf shed and derelict buildings. Some records were damaged by mould, water, rubble and animal droppings. The DPC also found that records had been retained longer than necessary and that some breaches had not been reported promptly to either the regulator or the people/patients affected.

The DPC imposed four fines totalling €645,000 and ordered the HSE to audit its storage facilities, remove records from unsuitable locations and introduce a proper system for tracking and managing paper records. The HSE’s previous similar data-protection failures were treated as an aggravating factor.

But who will really pay this fine?
The HSE is funded mainly with public money. Therefore, the €645,000 will not come from the pockets of the officials responsible. It will come from resources that could otherwise have been used for patients, staff and health services.
Once the fine has been confirmed by a court and collected, the DPC must transfer the money to the Government’s Central Fund, namely the Irish Exchequer. It does not go to the patients whose records were mishandled, and it does not remain with the DPC.
The result is that one taxpayer-funded public body pays another part of the State. The money leaves the HSE’s budget and returns to the general Exchequer.

The HSE will then find itself €645,000 short in its future dealings with patients and support services, unless it can absorb the loss elsewhere. If it seeks additional funding, that money will again have to come from the taxpayer. The HSE cannot simply demand the fine back, but future governments may provide it with increased funding through the normal budget process.

Is this not ridiculous?
The HSE must certainly be held accountable for the disgraceful treatment of sensitive medical records. Strong corrective action, public accountability and consequences for those responsible are entirely justified. However, taking money from the health service, placing it in the Exchequer and potentially providing more taxpayers’ money to the HSE later looks like public money being moved in a circle.

Meanwhile, patients may face the real cost through reduced resources or delayed services, although they did nothing wrong. The people directly responsible may suffer no personal financial consequence, while taxpayers effectively pay the penalty.

The fine sends a public message, but it raises a serious question; is moving €645,000 of taxpayers’ money from one State account to another really the best way to hold a public body accountable?

Meaningful accountability should correct the failures without making patients and ordinary taxpayers pay for the same institutional mistakes again.