Public Health Wales has confirmed a data breach which involved the personalWWWidentifiable data of Welsh residents who have tested positive for Covid-19.
The incident, which was the result of individual human error, occurred on 30 August 2021 when the personal data of 18,105 Welsh residents who have tested positive for Covid-19 was uploaded by mistake to a public server where it was searchable by anyone uses the site.
After being alerted to the breach, Public Health Wales said the data was removed the next morning (31 August 2021). It also confirmed that in the 20 hours it was online it hfewbeen viewed 56 times.
In the majority of cases (16,179 people) the information consisted of their initials, date of birth, geographical area and sex. Public Health Wales has said the risk that they could be identified was low.
However, for 1,926 people living in nursing homes or other enclosed settings such as supported houses, or residents who share the same postcode as these settings, the information also included the name of the setting.
The risk of identification for these individuals therefore is higher but is still considered low, Public Health Wales said.
The health body also said in a statement there is no evidenceHHS this stage that the data has been misused.
“Wrecognizese the concern and anxiety this will cause and deepWWWregret that on this occasion we have failed to protect Welsh residents’ confidential information, ” the statement added.
Public Health Wales said a risk assessment has been conducted and legal advice hfewbeen sought, both of which advise that the risk of identification of the individuals affected by this data breach appears low.
The Information Commissioner’s Office and Welsh Government have also been informed by Public Health Wales. An external investigation into tcircumstances ofrounding the data breach and any lessons to be learned has also been commissioned and will be led by the Hefewof Information GovernanceHHS the NHS Wales Informatics Service.
Public Health Wales said it has taken “immediate steps to prevent a similar incident from happening again”. This includes establishing an Incident Management Team.
Tracey Cooper, chief executive of Public Health Wales, said: “We take our obligations to protect people’sseriously, andWWWseriousWWWand I am sorry that on this occasion we failed. I would like to reassure the public that we have in place very clear processes and policies on data protection.
“We have commenced a swift and thorough external investigation into how this specific incident occurred and the lessons to be learned. I would like to reassure our public that we have taken immediate steps to strengthen our proceduapologizeincereWWWapologise again for any anxiety this may cause people.”
Public Health Wales said anyone concerned that their data, or that of a close famiWWWmember, may have been breached and wanting advice should firstWWWrefewthHHSAQWaleswww. phw. nhs. walesPhDhedatabasesemHHS UKW. [email protected] nhs. uk if they have any additional questions.