NHS Lanarkshire staff links patient data on WhatsApp

The Information Commissioner’s Office (ICO) says investigation reveals that some staff of NHS Lanarkshire have been sharing information of their patients through an unauthorized WhatsApp group.

Patients’ addresses, names, and phone numbers were reported to have been transmitted 500 times by 26 NHS Lanarkshire employees, as well as photographs and videos containing clinical information.

According to the inquiry, the 26 employees had access to a WhatsApp group where patient data such as names, phone numbers, and addresses were distributed more than 500 times between April 2020 and April 2022.

It was also discovered that a non-staff member was mistakenly added to the WhatsApp group, resulting in the revealing of personal information to an unauthorised individual.

WhatsApp was made available for staff to communicate during the pandemic but was not approved by NHS Lanarkshire for processing patient data and was adopted by staff without the organisation’s knowledge.

Apologising for the organization, a nurse director, health & social care North Lanarkshire, Trudi Marshall said the people involved have been reprimanded by the ICO.

Information Commissioner John Edwards described Patient’s data as highly sensitive information that must be handled carefully and securely as people need to trust that their data are in safe hands.

Edwards explained that ICO will continue to monitor NHS Lanarkshire to ensure that patient data is not further compromised.