Medical clinic inadvertently sends health records to the Health Practice Board (2023-06-08)

Summary

This is a case summary published by the Cayman Islands Ombudsman describing a resolved data protection complaint. A medical office accidentally emailed health records supporting a doctor's application to the Health Practice Board (HPB), triggering a personal data breach review under the Data Protection Act framework.

• What happened: The medical office sent an email with health records to the HPB in error, and the doctor concerned was informed of the breach.
• Initial response: The administrative officer attempted a message recall and asked recipients to delete the email, but the recall was unsuccessful and not all recipients confirmed deletion.
• Ombudsman's role: After being notified, the Ombudsman prompted the data controller to seek further deletion confirmations, which were then obtained from the remaining HPB recipients.
• Outcome: The case was resolved informally; the medical office was referred to the Ombudsman's website for guidance on responding to personal data breaches.

This is an informational case summary illustrating expected breach-response practice rather than a rule or enforceable instrument, so it does not itself create new binding obligations beyond existing data protection duties to respond promptly and thoroughly to breaches.

Applies to

data controllers, medical clinics