A woman sent someone else’s coronavirus test results by accident has told Sky News the data breach is “extremely worrying”.
Claire Hyman, 47, woke up to two text messages from the NHS on Monday to say an unknown woman in her 40s had tested negative for COVID-19.
The messages, seen by Sky News, state the woman’s full name, date of birth, test date and result.
“I saw the text when I was still in bed and without my glasses I could just see NHS and COVID and I thought ‘why are they contacting me?’,” Mrs Hyman said.
“I knew it was a data breach straight away. I wouldn’t be happy if I was that woman. They shouldn’t be sending personal, sensitive data like that to the wrong person. It’s extremely worrying.”
Mrs Hyman got a coronavirus test done on 10 January at a walk-in site near her East Sussex home after two weeks of being ill. She received a negative test result the following day.
The mother-of-six says she was “reluctant” to get tested over fears her data could be misused, but after two weeks of body aches, extreme headaches and a loss of taste, she felt she had no choice.
“I was really reluctant to get a test and give my data anyway, it was only because I was so ill and some friends had tested positive over the Christmas period.
“This has just highlighted the risks of sharing personal data with the authorities.”
Sharing personal details such as someone’s name, address, date of birth or other contact details without permission is a breach of the General Data Protection Regulation (GDPR), which governs data law in the UK.
If the breach goes unreported within 72 hours it can be punishable by a fine of up to 2% of the organisation’s turnover.
It comes days after the private company Serco, which manages NHS Test and Trace, suffered a cyber attack.
A spokesperson for the firm said its NHS systems were not affected, but it follows a number of issues with the service.
Sky News reported late last year that NHS bosses had published plans to build public confidence in the scheme after a string of errors and calls for its chief, Baroness Dido Harding, to resign.
Meanwhile, Mrs Hyman, a mature law student, is concerned for the woman whose results she received.
“This poor woman, she’s probably self-isolating and doesn’t know if she’s okay to go out or not.
“She needs to know and has no way of knowing. Maybe she has an elderly relative she’s worried about giving it to.
“There are people extremely worried about COVID and she’s probably waiting nervously, anxiously by the phone.”
Phil Booth, coordinator at Med Confidential said: “Breaches like these are always concerning, especially when they turn out to be systemic errors, not isolated incidents.”
He urged anyone with a similar issue to report it to the watchdog, the Information Commissioner’s Office (ICO).
Data protection charity, Open Rights Group, described the data breach as “potentially dangerous” and one that risks undermining efforts to stop the spread of the virus.
Executive director Jim Killock told Sky News: “We have repeatedly warned about the need to get data protection right, but Health Secretary Matt Hancock has dismissed safeguards as ‘bureaucracy’.
“Data errors undermine trust, and make people reluctant to hand information over. It can mean that people know about each others’ health conditions, which is unfair and potentially dangerous for them.
“When data is misused and shared inadvertently, this could have a negative impact on people seeking testing and the fight against COVID-19.”
A Department of Health and Social Care spokesperson said: “NHS Test and Trace is processing over 400,000 tests a day, from more than 800 test centres and mobile units, with the vast majority of people reporting no issues with the process.
“Everyone who tests positive is contacted directly and informed of their results either by text or email. Anyone who has not received their result from an in-person or home test after 5 days is advised to call 119.”
Have you received the wrong coronavirus test result? Email your story to lara.keay@sky.uk.