Azienda Usl Valle d'Aosta: Insufficient technical and organisational measures to ensure information security

The Italian DPA has fined Azienda Usl Valle d'Aosta EUR 40,000. An employee and patient of the health department had filed a complaint with the DPA because a colleague who had never treated them had repeatedly accessed their medical file, despite the fact that they had explicitly refused their consent to the data processing. During its investigation, the DPA found that, in order to simplify patient management during the Covid 19 pandemic, the health department had simplified the medical record system. As a result, patient medical records were accessible to any employee, whether or not the affected patient had consented to it. The DPA considered this a violation of the obligation to implement appropriate technical and organizational measures to protect personal data.

Industry: Health Care