A Welsh health board has become the first NHS organisation to be fined following a serious breach of the Data Protection Act.

The Information Commissioner’s Office has today issued the Aneurin Bevan Health Board with a penalty of £70,000 after a sensitive report – containing explicit details relating to a patient’s health – was sent to the wrong person.

The error occurred when a consultant emailed a letter to a secretary, but did not include enough information for the secretary to identify the correct patient.

The doctor also misspelt the name of the patient at one point, which led to the report being sent to a former patient with a very similar name. The mistake occurred in March last year.

A subsequent investigation by the ICO found neither member of staff had received data protection training and the board did not have adequate checks in place to ensure personal information was sent to the correct person.

“Poor practices” were also used by other clinical and secretarial staff across the organisation, the ICO concluded.   

ICO head of enforcement Stephen Eckersley said: “This case could have been extremely distressing to the individual and their family and may have been prevented if the information had been checked prior to it being sent. 

“We are pleased that the health board has now committed to taking action to address the problems highlighted by our investigation; however organisations across the health service must stand up and take notice of this decision if they want to avoid future enforcement action from the ICO.”

In a statement, the board said: “We accept the decision by the Information Commissioner’s Office and have acted promptly on the points raised in their report.”