The Italian Data Protection Authority sanctions three hospitals for communicating data to unauthorized third parties

At the end of January 2021, the Italian Data Protection Authority highlighted that such measures must also be taken to ensure that their patients' data are not accidentally disclosed to other people.

In this regard, the Italian Authority sanctioned two hospitals and one Local Health Agency for personal data breaches caused by inadequate procedures and simple error of its staff.

In specific terms, a hospital in Tuscany was fined EUR 10 000 for having sent by mail, to the wrong patient, a medical report containing information on the health and sex life of another couple.

Another example could be a hospital in Emilia-Romagna was also fined €10,000 for having given patients’ medical records containing data and reports referring to other people, including a minor.

In both cases, the Italian Data Protection Authority, punishing the two hospitals, calculated the fine taking into account that the healthcare organizations had:

A third case concerned a Local Health Agency in Emilia-Romagna, where a patient had explicitly requested - by signing a special form – that nobody, not even family members, should be informed of his medical conditions. The form had been included in the medical folder of the department. However, a nurse belonging of this department (where the woman was receiving treatment) was unaware of the request and, instead of contacting her on her private mobile phone, called her home number registered in the company registry, thus speaking to a family member.

In this case too, the Local Health Agency acknowledged the errors that caused the data breach and committed itself to implement a computerized system for managing the telephone numbers of in-patients, and to prepare a single form with which patients could express their wish to communicate information on their state of health to third parties, introducing a specific internal policy.

The Local Health Agency, which has also received a claim for damages from the patient, will have to pay a fine of EUR 50,000 for the violation.

In the light of these episodes, and of others still being investigated, the Italian Data Protection Authority: