Staff at the prestigious hospital at the center of a data breach over the Princess of Wales’ private medical records may have had to face a ‘deception’ trap set by managers, experts believe.
The Ministry of Health can reveal that, three months on, the London Clinic remains under investigation and the case has not yet been referred to Scotland Yard, despite Health Secretary Maria Caulfield saying in March that police had been asked to look into it.
Bosses at the hospital launched an investigation after it was alleged that at least one member of staff had attempted to access personal details about Kate following her scheduled abdominal surgery in January.
It is a criminal offense for any NHS or private healthcare staff to access a patient’s medical records without the consent of the organisation’s data controller.
Now, some data specialists have told this newspaper that, if the breach had occurred, staff could have been caught through a ‘deception’ tactic used by private hospitals that often have high-profile clients.
The Princess of Wales was receiving private medical care at the London Clinic when staff were accused of trying to access her personal details after scheduled abdominal surgery.
The London clinic remains under investigation. It is a criminal offense for any NHS or private healthcare staff to access a patient’s medical records without consent
Health Minister Maria Caulfield has requested that the case be investigated by the police
To protect the health records of VIP patients, hospitals often store them in a file with a fake name.
A ‘decoy’ file is then created under the celebrity’s real name. This contains false information and is regularly checked by bosses to see if any rogue personnel have opened it without permission.
If a breach is suspected, hospitals are required to launch their own investigation while the Information Commissioner’s Office (ICO) investigates whether management made any mistakes. But this process is very slow.
Sam Smith, of the health data privacy group MedConfidential, said: “It is disappointing but sadly normal that three months on there is no update on the investigation.”
He said data breaches were ‘unfortunately common’, adding: ‘It’s rare that people find out when a data breach has happened, and even rarer that they can get evidence of it. prove it, and if they do, the process is still very slow. ‘
Tom Llewellyn, a partner in commercial litigation and data protection at law firm Ashfords, said: “It can take years for action to be taken against individuals.”
He highlighted a similar case last year when a former NHS secretary was fined £648 for accessing the medical records of more than 150 patients – four years after the breaches took place.
Last month, a hospital doctor was fired from his job three years after reading the health records of a woman he met on a dating app in 2021.
The London clinic has not provided any updates since the alleged breach of the Princess of Wales’ health data was reported.
The ICO told the MoH: “Investigations into reported data breaches can be very complex and our team of experts must be given the appropriate time to ask their questions.
To protect the integrity of a live investigation, we will not provide regular updates on its progress to those not directly involved until it is concluded.’
The Met Police confirmed they were “unaware of any referrals” relating to the offence.
Kensington Palace said: “This is a matter for the London Clinic.”
