Information Commissioner: Persistent sensitive information breaches failing people living with HIV

• People living with HIV denied "basic dignity and privacy" by repeated data breaches that disclose their HIV status
• ICO calls for "urgent improvements" throughout the UK
• Regulator working with HIV charities to improve support offered to people living with HIV on how their sensitive information is handled

Information Commissioner John Edwards has condemned data protection standards at health services for people living with HIV and called for urgent improvements. The statement follows several data breaches, as well as concerns raised by some of the largest HIV organisations in the country.

Information Commissioner John Edwards said:

"People living with HIV are being failed across the board when it comes to their privacy and urgent improvements are needed across the UK. We have seen repeated basic failures to keep their personal information safe - mistakes that are clear and easy to avoid.

"Over the past few decades there have been remarkable advances in treatment and support for those living with HIV, but for people to be able to confidently use that support, they must be able to trust that when they share their personal information, it is being protected.

"We know from speaking to those living with HIV and experts in the sector that these data breaches shatter the trust in these services. They also expose people to stigma and prejudice from wider society and deny them the basic dignity and privacy that we all expect when it comes to our health.

"The ICO takes each one of these data breaches very seriously and recognises the detrimental impact they can have on the lives of those affected. We are making sure that the improvements we all want to see, such as better training, prompt reporting of personal information breaches and ending the use of BCC for sensitive communications, are being implemented as swiftly as possible."

Adam Freedman, Policy, Research & Influencing Manager at National AIDS Trust, said:

"We are very supportive of today's statement by the ICO. Strong regulatory action is needed when organisations breach protection of HIV status data, which unfortunately continues to carry with it more harmful stigma than other types of personal data.

"People living with HIV need the confidence to know that they have recourse when their data rights are breached, and to prevent risk of further discrimination and harassment. Someone's HIV status is personal data and it should be a person's choice to decide whether or not they share that information.

"We are pleased to see the ICO recognising the detrimental impact such data breaches can have on people living with HIV, and welcome this much needed intervention."

Jacquie Richardson, Chief Executive of Northern Ireland HIV charity, Positive Life, said,

"This serves as a timely reminder of the importance of patient confidentiality and privacy. Here in Northern Ireland, stigma around HIV still carries a huge burden. Our service users tell us of the worry of being seen or overheard in any setting in which they need to disclose their status, and the fear of how they will be treated as a result.

"HIV stigma is based on vastly out-dated and inaccurate information but this doesn't lessen the impact of being on the receiving end of these prejudices. Along with public health partners, we continue to work to educate around HIV and the U=U message: modern treatment means the virus becomes undetectable and is therefore untransmittable.

"This warning from the Information Commissioner should remind all of us that someone's HIV status requires sensitivity and discretion at all times."

In the year 2022/3, the health sector accounted for over a fifth of all personal data breaches, making it the most common source of reports to the ICO.

The statement today follows another fine issued by the Information Commissioner's Office (ICO) to a HIV service provider.

The ICO has issued a fine to The Central Young Men's Christian Association (the Central YMCA) of London for £7,500 for a data breach where emails intended for those on a HIV support programme were sent to 264 email addresses using CC instead of BCC, revealing the email addresses to all recipients. This resulted in 166 people being identifiable or potentially identifiable. Central YMCA has now paid the fine in full.

A formal reprimand has also been issued. The fine was initially recommended to be £300,000, but this was subsequently reduced in line with the ICO's public sector approach. This approach, which the ICO is currently trialling, is where fines for public sector bodies are reduced where appropriate alongside wider use of other enforcement powers, such as reprimands. This is designed to reduce how much public money is used to pay fines for organisations' errors, which often end up impacting those who need these public services.

The ICO has previously issued fines or reprimands for data breaches affecting people living with HIV to charity HIV Scotland and health board NHS Highland. Both of these data breaches were due to mistakes in using BCC emails for sensitive communications - something the ICO called on organisations to stop last year.

The ICO is further calling for better staff training, appropriate technical procedures and prompt reporting from HIV services.

The ICO has also been working with leading HIV and domestic abuse charities to improve the support given to people who may be in vulnerable situations and have had their data breached. More information will be shared on this work in the coming weeks.

Advice to people living with HIV who may have been the victim of a data breach

If you have been the victim of a data breach related to your HIV status or other personal information:

• First complain directly to the organisation in question.
• If you are dissatisfied with their response, or if you do not receive a response, you can file a complaint to the ICO. Our complaints tool can be found here. You may also wish to contact community support services such as National AIDS Trust, Terrence Higgins Trust or Positive Life.

The ICO can consider complaints about the way your information has been handled and whether there has been an infringement of data protection law. We will share a decision about what we think should happen next.

We can make recommendations to organisations to put things right or to improve their practices when we think it is necessary to do so. Where we have significant concerns about an organisation's ability to comply with the law, we can take enforcement action.

Advice for HIV services

A person's HIV status is highly sensitive information that must be handled with care. When accessing healthcare and other vital services, people need to trust that their medical information is safe and only available to authorised employees.

Healthcare organisations should ensure:

• Staff are thoroughly trained: Organisations should have data protection training in place that is role-specific, tailored and relevant to the tasks being completed. Staff should feel confident in handling people's personal information safely and securely. It must be clear to staff about what records they are allowed to access.
• Appropriate technical measures are in place: Appropriate measures, such as passwords and access controls, should be in place to ensure personal information can only be seen by people who need to use it.
• Do not use BCC when sending bulk communications: Failure to use BCC correctly in emails is one of the top data breaches reported to us every year - and these breaches can cause real harm, especially where sensitive personal information is involved. While BCC can be a useful function, it's not enough on its own to properly protect people's personal information. If organisations are sending any sensitive personal information electronically, or are contacting individuals regarding health-related matters, they should use alternatives to BCC, such as bulk email services, mail merge, or secure data transfer services. Guidance on usage of BCC can be found here.
• Staff are clear on the data breach reporting process: An organisation must report misuse of personal data to the ICO if there is a risk to people's rights and freedoms, which is often the case with sensitive medical information. This must be reported within 72 hours of becoming aware of the breach. More information on breach reporting here. Personal information breaches are treated seriously, and with the recognition that individuals affected been denied dignity and privacy that we all expect when accessing healthcare services.

Click to toggle detailsNotes to editors 

Public link

Please use the above public link if you want to share this noodl on another website.