A Welsh health board has become the first NHS organisation to be issued a monetary penalty by the The Information Commissioner’s Office (ICO) following a serious data breach.

The Aneurin Bevan Health Board (ABHB) has been hit with a penalty of £70,000 after sensitive data - containing explicit details relating to a patient’s health - was sent to the wrong person in March last year.

The error occurred when a consultant emailed a letter to a secretary for formatting, but did not include enough information and also misspelt the patient name. The errors led to the report being sent to a former patient with a very similar name.

Stephen Eckersley, the ICO’s Head of Enforcement said: “The health service holds some of the most sensitive information available. The damage and distress caused by the loss of a patient’s medical record is obvious, therefore it is vital that organisations across this sector make sure their data protection practices are adequate.

“Aneurin Bevan Health Board failed to have suitable checks in place to keep the sensitive information they handled secure. This case could have been extremely distressing to the individual and their family and may have been prevented if the information had been checked prior to it being sent.

“We are pleased that the Health Board has now committed to taking action to address the problems highlighted by our investigation; however organisations across the health service must stand up and take notice of this decision if they want to avoid future enforcement action from the ICO.”