What Happened
In late 2023, intruders accessed two disused psychiatric hospitals in Ireland, filming unsecured paper medical records and posting the footage on social media. These locations, St. Loman's Hospital in Mullingar and St Conal's Hospital in Letterkenny, were used by Ireland's Health Service Executive (HSE) for document storage.
The Data Protection Commission (DPC) launched an inquiry in May 2024. The investigation revealed that the HSE failed to secure sensitive health records adequately and ensure document integrity at external storage facilities. Consequently, the DPC issued €645,000 in fines, a formal reprimand, and multiple compliance orders.
Timeline
October 2023: First breach notification received by DPC after unauthorized access at one location.
November 2023: Second breach notification following similar unauthorized access at another location.
May 24, 2024: DPC formally begins inquiry into HSE's paper records processing.
2024 (conclusion date not specified): DPC issues final decision with financial penalties and compliance orders.
Which Controls Failed or Were Missing
The HSE's failures highlight critical data protection requirements that apply to both physical and digital records:
Inadequate physical access controls. Disused buildings with sensitive medical records were accessible to unauthorized individuals. This is a fundamental breach of the obligation to protect personal data from unauthorized processing.
Failed environmental controls for document storage. The DPC cited failures in "the physical conditions of HSE document storage facilities." Medical records need controlled environments to prevent degradation and unauthorized access. The HSE treated these facilities as passive archives rather than active data processing locations requiring ongoing security measures.
Insufficient document integrity monitoring. The DPC noted failures regarding "the integrity of the documents held within those facilities." Without effective mechanisms to verify the state of records, compliance cannot be demonstrated. The HSE lacked systems to ensure records remained intact and protected from tampering or environmental damage.
Weak third-party management controls. The breaches suggest inadequate vendor management, insufficient security requirements in contracts, and lack of ongoing oversight at external storage facilities.
What the Relevant Standard Requires
Under Article 5(1)(f) of the General Data Protection Regulation, controllers must process personal data "in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures."
The regulation applies equally to digital and physical records. Your obligations are the same whether data is on a server or in a filing cabinet.
Article 32 requires implementing "appropriate technical and organizational measures to ensure a level of security appropriate to the risk." For special category data like medical records (Article 9), the risk assessment must consider the severe harm unauthorized disclosure can cause.
Physical security measures must include:
Perimeter security and access control. Even disused facilities need locks, alarms, and access logging if they contain personal data.
Environmental monitoring. Verify that storage conditions won't damage records and that unauthorized access attempts are detected.
Regular security assessments. Article 32(1)(d) requires "a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures." This applies to storage facilities, not just networks.
Vendor due diligence. Article 28 requires written contracts with processors specifying security obligations. If using external storage, you need contractual guarantees about facility security, access controls, and incident notification.
For those subject to HIPAA in the United States, the Physical Safeguards standard at 45 CFR § 164.310 requires facility access controls, workstation security, and device and media controls. The Security Rule includes paper records within its scope.
Lessons and Action Items for Your Team
Audit your physical storage locations this quarter. Visit every facility storing paper records with personal data. Document access controls, environmental conditions, and document organization. If you can't produce a current inventory, there's a control gap.
Treat decommissioned facilities as active risks. The HSE's failures occurred at "disused" hospitals. Your organization may have similar locations: closed offices, legacy storage rooms, facilities pending sale. Until records are destroyed or relocated, you're still the controller.
Write physical security requirements into vendor contracts. If using third-party storage, contracts must specify access controls, environmental standards, audit rights, and incident notification timelines. Generic agreements won't satisfy Article 28. Security annexes must address specific data risks.
Implement a retention schedule with teeth. Many organizations keep paper records longer than necessary. Set clear retention periods, fund destruction programs, and document disposal in your records of processing activities.
Test your incident detection for physical breaches. The HSE learned about breaches from social media, not their own monitoring. Install intrusion detection, require visitor logs, and audit access records monthly.
Integrate physical controls into your ISO/IEC 27001 program. Annex A control 7.4 addresses physical security monitoring. Control 7.2 covers supporting utilities. Control 7.3 deals with securing offices, rooms, and facilities. If these controls are marked "not applicable" because you've focused on data centers, revisit that assessment.
The €645,000 fine sends a clear message: regulators won't accept the excuse that you forgot about physical records while building your digital compliance program. Your paper files carry the same obligations, risks, and now, penalties.
