ICO reprimands NHS Lanarkshire for sharing patient data via WhatsApp

Summary:

The Information Commissioner's Office (ICO) has issued a reprimand to NHS Lanarkshire for allowing unauthorised use of WhatsApp to share patient data over a two-year period. Between April 2020 and April 2022, 26 staff members had access to a WhatsApp group where patient data was shared on over 500 occasions. The ICO investigation found that NHS Lanarkshire did not have the necessary policies, guidance, and processes in place when WhatsApp was made available to download. The reprimand recommends that NHS Lanarkshire take action to ensure compliance with data protection law, including implementing a secure clinical image transfer system, assessing risks relating to personal data, and providing explicit communications to employees on their data protection responsibilities.