Data breach an isolated incident says Manx Care

160 patients contacted after patient records found in ex-employee's home

Manx Care insists a data breach where 'huge volumes' of patient records were found at a former employee's home was an isolated incident.

The healthcare provider's written to 160 people after the documents were discovered in September last year.

It's apologised 'unreservedly' for the breach, and says the current safeguards have been further strengthened to prevent an incident like this happening again.

Chief Executive Teresa Cope says it's taken a significant amount of time to identify who was affected:

You can listen to Mrs Cope's interview in full here.

Manx Care has since released the following statement:

"In response to certain ill-informed comments on the recent reported data breach, we thought it would be helpful to clarify what “Duty of Candour” is and explain how it informs patients and carers if there has been an error during their care.   

Duty of Candour

The Introduction of Duty of Candour was one of the core recommendations of the Sir Jonathan Michaels Independent Review published in 2019 and became law in April 2021, as part of the Manx Care Act when Manx Care was established.  

This brought the Isle of Man in line with England where statutory Duty of Candour had been a legal requirement since 2014 and made it a legal requirement for organisations to inform patients and carers or if there had been an error during their care. 

It is important to affirm that up until April 2021, there was no legal duty of the Health and Social Care organisation to be open and transparent and share information with the people who have been affected by an error in their care and treatment. 

Duty of Candour is a crucial underpinning aspect of  a safe, open and transparent culture and something Manx Care is committed to upholding at all times.  

Duty of Candour extends to all services within Manx Care, we have a clear policy for Duty of Candour and our staff are trained in this. As an organisation we support and encourage our staff to report incidents and near misses openly. Manx Care follows robust processes for the management and remediation steps required following an incident to ensure lessons can be learned to drive improvement and where possible mitigate recurrence.

Manx Care is a large organisation handling ‘special category’ (health) data across more than 100 different digital and paper based systems on a daily basis. Until funding is secured to support the introduction of a single electronic patient record (i.e. Manx Care Record as recommended by Sir Jonathan Michael) the processes associated with passing information between existing systems and supporting staff will likely continue to result in more frequent data breaches.

In relation to the data breach reported last week; despite this data breach happening a number of years before Manx Care was established, it is important that we reported and comprehensively investigated this breach, apologised to those affected by this historic breach and identified what further lessons can be learned – which we have."