+34
The Data Protection Commission has reprimanded Children's Health Ireland Tallaght for failing to ensure the confidentiality of patient records. An unannounced inspection revealed that hundreds of patient charts were stored in a shared office with a propped-open door, making them accessible to passersby. Additionally, sensitive data was found overflowing from a waste bin near the office entrance. The commission determined the hospital infringed the General Data Protection Regulation regarding the security and confidentiality of personal data and ordered the facility to comply.
The State’s data watchdog has reprimanded Tallaght children’s hospital for “failing to ensure” healthcare records were stored and retained in a confidential manner. Last year, The Irish Times revealed that the Data Protection Commission had conducted an unannounced inspection of a shared office for non-consultant hospital doctors on the first floor of the hospital on July 16th, 2025.
It is understood the door to the shared office – where hundreds of patient charts were stored – was propped open, making it accessible to people walking by. When closed properly, the door is locked with a keypad. The inspection was conducted after the commission received a protected disclosure. Following this, the DPC announced it was starting an inquiry into Children’s Health Ireland Tallaght.
In a statement on Thursday, the DPC said during the protected disclosure process, it became aware that documents “containing both sensitive and special-category data of children had been over-flowing, and subsequently removed, from a confidential waste bin”. The bin was located beside the door to the NCHD office.
“Collectively, these issues highlighted security concerns surrounding the confidentiality of children’s personal data which was stored and retained in paper records in the NCHD office at CHI and the proper management and control of those records,” the statement said. The commission found CHI Tallaght “infringed” the General Data Protection Regulation on two grounds, primarily relating to security and confidentiality of personal data.
According to the commission, the hospital failed to ensure personal data was “processed in a manner which ensured the appropriate security and confidentiality of that data”. The DPC said it had reprimanded CHI Tallaght and “ordered” the facility to bring its processing of personal data into compliance with the GDPR. It said it would publish the full decision “in due course”.
Dr Turlough Bolger, a consultant in emergency medicine and clinical director at CHI Tallaght, sent an email to staff at the hospital the day after the DPC’s inspection. He said the watchdog had “expressed concern” about the number of patient charts in the room, as well as the number of loose pages with patient details.
“I expect that the recommendations will be wide-ranging and damaging to CHI at Tallaght,” he told staff. Bolger said he appreciated the “hard work” done by staff to reduce the number of outstanding discharge charts in recent weeks, which saw a “significant reduction” from 900 to 600 charts.
“I have said repeatedly that there needs to be a sustainable approach to this issue. Ultimately, as the accountable officer in CHI at Tallaght, I am responsible for the overall situation regarding medical records. ” In a statement after the inspection, a spokeswoman for CHI said “immediate measures” were taken to “reduce any potential risk, including reinforcing physical safeguards and engaging directly with staff”.
Data Protection Commission Children's Health Ireland Tallaght GDPR Infringement Patient Data Security Hospital Privacy Breach
Ireland Latest News, Ireland Headlines
Similar News: You can also read news stories similar to this one that we have collected from other news sources.
Manchester City Found Guilty of Financial Rule Breaches by Premier League CommissionAn independent commission has declared Manchester City guilty of breaching Premier League financial rules through sham sponsorship deals and undeclared funding from Abu Dhabi United Group, amounting to more than £900 million in inflated revenues and reduced expenses between 2009-10 and 2017-18. The league will now decide on sanctions in a separate hearing. Manchester City retains the right to appeal until 2 October.
Read more »
Site next to Square in Tallaght with planning permission for 199 apartments seeks €5.9mFormer Woodies site sold for €20m to developer Bernard McNamara at height of Celtic Tiger era
Read more »
European Commission to put Ireland’s poor climate action record under scrutinyClimate commissioner Wopke Hoekstra says emission reduction targets must be taken very seriously
Read more »
Minecraft and Candy Crush among games targeted by consumer watchdogEuropean Commission’s Consumer Protection Cooperation Network focusing on nine online gaming companies in investigation
Read more »