Cybersecurity Policy Report, ICO Seeks to Stem Breaches of HIV Patients’ Privacy, (May 1, 2024)

By Tony Foley

The United Kingdom’s Information Commissioner’s Office (ICO) yesterday said it was calling for urgent improvements in data protection standards at health services treating patients living with HIV.

According to a news release, the ICO’s condemnation of these lax standards follows several data breaches, as well as concerns raised by some of the largest HIV organizations in the country. “People living with HIV are being failed across the board when it comes to their privacy and urgent improvements are needed across the UK. We have seen repeated basic failures to keep their personal information safe—mistakes that are clear and easy to avoid,” said Information Commissioner John Edwards. “Over the past few decades there have been remarkable advances in treatment and support for those living with HIV, but for people to be able to confidently use that support, they must be able to trust that when they share their personal information, it is being protected.”

Commissioner Edwards added that the agency took each reported breach of HIV information seriously and recognized the impact they had on affected people’s lives. “We are making sure that the improvements we all want to see, such as better training, prompt reporting of personal information breaches and ending the use of BCC for sensitive communications, are being implemented as swiftly as possible,” he concluded.

The news release also outlines a fine issued against the Central YMCA of London, an HIV service provider, based on a data breach in which e-mails were sent to more than 250 e-mail addresses using the CC line rather than the BCC line, revealing the e-mail addresses of all recipients. The fine was initially set at 300,000 British pounds sterling ($375,000) but was reduced in line with the ICO’s public sector approach to 7,500 pounds sterling ($9,370).

The ICO further called for better staff training for HIV service providers, appropriate technical procedures, and prompt reporting. The agency has been working with leading HIV and domestic abuse charities to improve support given to people who may be in vulnerable situations and may have had their data breached.

News: InternationalLegislation DataSecurity DataBreach DataPrivacy