HSE Fined €645,000 Over Decaying Medical Records in Disused Hospitals
Published on 09/02/2026 at 17:07 | Editorial boerse-global.de
The Data Protection Commission (DPC) has issued a €645,000 fine to the Health Service Executive (HSE) after an inquiry uncovered personal medical records rotting in unsuitable storage at two former psychiatric hospitals. The penalty, announced on Wednesday, is the largest ever imposed by the regulator on a public body, serving as a stark warning to organisations across the UK and Ireland about the consequences of failing to safeguard sensitive data.
Records Found in Turf Sheds and Disused Bathrooms
The investigation centred on systemic failings at St Loman's in Mullingar and St Conal's in Letterkenny. Inspectors found paper records in a state of "profound disarray," with documents kept in locations wholly unsuitable for data storage, including a turf shed and a disused bathroom. Many files were contaminated by animal droppings, destroyed by mould, covered in rubble, or rotting from extensive water damage.
The DPC launched its formal inquiry in May 2024 after being notified of two significant data breaches in late 2023 involving unauthorised access to the two former hospital sites. Over the course of the investigation, inspectors conducted 12 site visits to assess the physical security and condition of the stored data.
Asbestos and Mould Complicated Storage Conditions
At St Loman's, the presence of asbestos complicated the storage environment, while St Conal's was cited for severe mould and dampness. The inquiry determined that the HSE failed to implement appropriate security measures to protect personal data and neglected to dispose of records that were no longer required.
Under data protection law, organisations holding personal information must ensure it is kept secure and destroyed when it is no longer needed. The DPC also found that the health service failed to notify the regulator of the breaches within the mandatory 72-hour window and did not sufficiently inform the affected individuals.
HSE Apologises and Accepts Findings
The HSE has formally apologised for the storage conditions and stated that it accepts the findings of the DPC. In addition to the financial penalty, the commission issued a formal reprimand and corrective orders requiring the HSE to conduct a comprehensive audit of its storage facilities.
The enforcement action follows a history of similar issues within the organisation. The HSE was previously fined €65,000 in 2020 for failing to properly secure patient records. The current fine marks a significant escalation in regulatory oversight of sensitive medical documentation, and a clear signal that data protection authorities are prepared to hold public bodies to account for systemic failures.
