ICO Reprimands GP Surgery for Excessive Medical Data Disclosure

ICO News & Blogs

Filed February 3rd, 2026

Detected February 11th, 2026

Summary

The UK's Information Commissioner's Office (ICO) has reprimanded Staines Health Group for sending 23 years of a terminally ill patient's medical records directly to an insurer, instead of the requested five years to the patient. The ICO cited a lack of written processes and inadequate training as contributing factors.

View original document View source feed page

What changed

The Information Commissioner's Office (ICO) has issued a reprimand to Staines Health Group, an NHS GP surgery, for a significant data breach involving the excessive disclosure of a terminally ill patient's medical history to an insurance company. The surgery mistakenly sent 23 years of records directly to the insurer, rather than the five years requested for the patient's review. This incident, which the patient believes impacted their insurance payout, was attributed to a lack of clear written procedures for handling such requests and insufficient data protection training for staff.

This case serves as a critical reminder for healthcare providers and other organisations handling sensitive personal data. The ICO recommends implementing robust written processes for managing insurance requests, considering quality assurance measures for external data sharing, and ensuring regular, up-to-date data protection training for all staff. While Staines Health Group has taken remedial actions, including drafting new procedures and providing additional training, the ICO's reprimand highlights the serious consequences of mishandling sensitive health information and the need for stringent data protection practices to avoid distressing outcomes for individuals.

What to do next

Review and implement written processes for handling third-party data requests, especially for sensitive personal information.
Ensure all staff receive regular and up-to-date data protection training.
Establish quality assurance checks for all external data sharing.

Penalties

Reprimand issued

Source document (simplified)

GP surgery reprimanded after excessive medical history of terminally ill patient sent to insurer

Date 3 February 2026
Type News

We have reprimanded Staines Health Group for sending excessive medical details about a terminally ill patient to their insurance company.

A patient at the NHS GP surgery was diagnosed with a terminal illness and made a claim to their insurer. The insurer, on behalf of the patient, subsequently requested that five years of medical history be sent to the patient to review, before being sent to the insurer in order to progress the claim.

But, instead of five years of medical history being sent to the patient, Staines Health Group sent 23 years of medical records direct to the insurer. The patient believed the excessive disclosure of unnecessary medical records led to a reduction in the payout of their claim.

Failures of Staines Health Group that led to the incident included a lack of written process for staff to follow when handling insurance requests and a lack of regular refresher data protection training for staff.

David Doodson, ICO Interim Head of Investigations, said:

“All personal information must be handled with care but health records – sensitive personal data – require particularly robust measures. This is because the loss of this kind of data can have distressing consequences for those involved.

“We recommend other organisations take note of the lessons learned from the mistakes of Staines Health Group in this case.”
Staines Health Group took various steps after the incident including:

Completing a significant event report which aimed to establish the root cause of the disclosure email and what lessons could be learned from the incident.
Drafting a written document staff can follow when handling insurance requests
Updating its procedure for handling insurance provider requests to include additional training and a sign off sheet
Giving the member of staff responsible a warning and placing them under supervision for six months. We have issued Staines Health Group with a reprimand setting out the mistakes made in the handling of the request.

Lessons learned for other organisations include:

The need for written processes to be in place to support staff when handling personal data.
Consider the need for a quality assurance process when sharing personal data externally.
Provide up-to-date and regular data protection training for staff. Click to toggle details

Notes to editors

The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and information rights law, upholding information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
The ICO has specific responsibilities set out in the Data Protection Act 2018 (DPA2018), the United Kingdom General Data Protection Regulation (UK GDPR), the Freedom of Information Act 2000 (FOIA), Environmental Information Regulations 2004 (EIR), Privacy and Electronic Communications Regulations 2003 (PECR) and a further five acts and regulations.
The ICO can take action to address and change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit.
To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns.