UK Hospital Somehow Manages To Turn A Patient's Private Message Into Its Voicemail Greeting
from the how-may-we-misdirect-your-call dept
We’ve covered a lot of data breaches on this site over the years. Most involve the leakage of personal info via unsecured databases or careless data handling. But I doubt we’ve covered anything as bizarre as this. (via Databreaches.net)
A Devon hospital has apologised after a caller’s voicemail, containing personal patient details, became the hospital’s answerphone message for more than seven hours.
During that time the caller was inundated with calls from patients giving details about their health problems believing they were ringing North Devon District Hospital in Barnstaple.
Somehow, through the magic/convolutions of business phone systems, the message a woman left while calling to set an appointment for her husband somehow became the message greeting callers who were unable to reach a live human being.
Adding inconvenience to possibly tortious injury, the hospital somehow managed to route a number of inbound calls to the person whose message it had accidentally co-opted, resulting in the person (who had yet to discover her personal information had been compromised) fielding phone calls from other patients, who ended up sharing their personal info with a complete stranger.
The woman, who asked not to be named, said: “I didn’t think any more of it until an hour and a half later an elderly man called our home phone talking about his private parts as he had a problem and had to have an operation.
“I said to him, ‘I’m ever so sorry but I don’t know what you’re talking about?’. He replied, ‘they have given me your number’.
The hospital’s explanation for this incident isn’t very reassuring. It places the blame on outdated equipment. Unfortunately for people who don’t want their personal info handed over to complete strangers, there’s no telling how many public and private entities could make the same claim about their phone systems.
She said: “The phone lines were redirected and I was told it was completely human error because some parts of the hospital are still using old answer machines.”
And yet old answering machines are operated all the time without turning a message someone left into a voicemail greeting. Sure, it’s not impossible. But good god is it ever unlikely.
Stupidity before malice, as the saying goes. There’s no conceivable reason the hospital would want to generate this kind of press, so it would be irrational to think someone did this to deliberately harm this person. But harm was done nonetheless, and the combination of the UK’s Data Protection Act and the GDPR could result in a pretty hefty fine for the hospital. The going rate is “4% of turnover [gross revenue]” — something that has seen maximum fines rise from £500,000 (the amount charged Equifax) to £183 million (levied against British Airways).
Since the Devon hospital is unlikely to replace its hardware immediately, the risk of repetition still remains. Considering it’s apparently never happened before, the risk is low — but certainly not nonexistent. Adding humans to outdated tech will sometimes result in errors that aren’t easily replicated. Given that we’ve heard nothing comparable to this in the many years this blog has been running, this hospital’s inadvertent use of patient’s sensitive message as its own answering machine greeting is likely to remain a data breach unicorn.
Filed Under: data protection, devon, health information, privacy, uk, voicemail
Companies: north devon district hospital
Comments on “UK Hospital Somehow Manages To Turn A Patient's Private Message Into Its Voicemail Greeting”
The threat of a crazy fine is meant to prevent that—to make it cheaper to implement security than stick with the broken system.
Re: outgoing messages
"Thank you for calling the North Devon District Hospital. All our operators are currently engaged but you can choose one of the following voice selections:
For Admin – say One
For Accounts – say Three
For Outpatients – say Seven
To leave a recorded message – say Nine, or
to be transferred to our German Translation department, say Nein."
Re: Re: outgoing messages
to listen to someone’s personal information, press 7
Hospital can also be sued not only for GDPR, but for giving out private medical information, which is a protected class of data.
Not sure how age or obsolescence can cause such a thing, or cause the human error which causes such a thing.
Re: Re:
Pretty sure that "Age and Obsolescence" are fairly common causes of human error… And with the government looking to raise state pension age above the life expectancy of many parts of the UK, we’ll see many more errors in the future.
Re: Re: Re:
"Age and Obsolescence"
idk, I remember making plenty of errors at every stage of life.
How does obsolescence cause human error? Obsolete human knowledge or obsolete equipment being used?
Re: Re:
I am fairly certain that this ‘error’ took much more than age or obsolescence. In fact, I am having a hard time figuring a way it wasn’t deliberate, unless this was one of those answering machines that had two tapes, with the same size cassette, and for some obtuse reason the ‘error maker’ took both out at the same time and switched them.
As feeble as that explanation might be, it doesn’t answer the question about how someone decided to give out a patients phone number to other patients calling for advice. From my reading of the article, it wasn’t on the message, though that might be a misinterpretation.
Re: Re: Re:
If an error is possible, some user will accidentally find a way to make it sooner or later.
Re: Re:
A possible scenario: the hospital has two different phone messaging systems, one old, one new, which have different series of button presses to do the same thing. An employee who has to use both systems used the old one while thinking it was the new one, entered the wrong series of button presses, and created this disaster.
Thank you so much