The small print of greater than 18,000 individuals who examined optimistic for coronavirus had been printed on-line by mistake by Public Well being Wales.
The well being physique mentioned the information of 18,105 Welsh residents was viewable on-line for 20 hours on 30 August.
Most instances gave initials, date of delivery, geographical space and intercourse, that means the chance of identification was low, Public Well being Wales (PHW) mentioned.
Nonetheless 1,928 individuals in dwelling in communal settings had been extra in danger.
Nursing residence residents or these dwelling in supported housing additionally had the title of their place of residence printed, that means the chance, whereas nonetheless thought-about low, was larger.
The incident was the results of “particular person human error” when the data was uploaded to a public server searchable by anybody utilizing the positioning.
PHW mentioned the data had been seen 56 occasions earlier than it was eliminated however there was no proof up to now that the information had been misused.
What’s Public Well being Wales doing in regards to the information breach?
Chief government Tracey Cooper advised BBC Wales the failure was one of many “largest information breaches” she had come throughout and mentioned it “ought to by no means have occurred”.
Dr Cooper additionally mentioned Public Well being Wales may have acted extra rapidly in eradicating the data.
The one that was alerted to the breach on the night of 30 August after the data was posted at 14:00 that day didn’t comply with the physique’s severe incident reporting procedures.
The info was not eliminated till 09:55 the subsequent morning.
Discovering out why is a part of the phrases of reference of an exterior investigation which might be carried out by NHS Wales Informatics Service. “I believe we must always have taken it down faster,” she mentioned.
The workforce that “takes information safety obligations extraordinarily critically” was “devastated that this has occurred”, Ms Cooper mentioned.
“I can not apologise sufficient as a result of on this event we failed.”
Dr Cooper mentioned she was not contemplating resigning, saying: “I am the one who is accountable and as chief government that is the place the buck stops.
“I need to unravel it so I am not at this stage [considering my position].”
PHW mentioned it had already taken steps, together with ensuring any information uploads had been now undertaken by a senior workforce member.
What has the response been?
Welsh Conservative spokesman on well being, Andrew RT Davies MS, mentioned: “I acknowledge that the chance is taken into account to be ‘low’, however I am undecided that that might be a lot consolation to the almost 2,000 residents of care houses or different enclosed settings whose – albeit restricted – info was posted together with their place of residence.
“The well being minister seems to have sat on this for 2 weeks and completed a press convention earlier immediately with out disclosing this vital failing – and that is unacceptable.”
His Plaid Cymru counterpart, Rhun ap Iorwerth MS, mentioned: “Any information breach is severe, and this information breach together with potential technique of figuring out sufferers is of significant concern.
“Public Well being Wales and the Welsh Authorities have to have the ability to clarify how precisely this occurred, and provides assurances that this could’t occur once more.”
Second information breach
The Data Commissioner’s Workplace (ICO) and the Welsh Authorities have been knowledgeable. The ICO mentioned it could be making inquires following the alert.
That is the second time part of the Welsh NHS has needed to refer itself to the ICO over an information breach through the pandemic.
In April, NHS Wales Informatics Providers – the well being service’s IT arm – contacted the watchdog after 13,000 shielding letters had been despatched to the incorrect addresses.
Anybody involved that their information or that of an in depth member of the family may have been printed can get recommendation from Public Health Wales.
The Welsh Authorities mentioned it was a matter for Public Well being Wales.