Region Midtjylland has been fined 300,000 kroner for failing to adequately protect approximately 100,000 patient records between 2016 and 2020. The ruling was delivered by the Court in Horsens on Monday.

The issue arose due to the storage of records at the region’s Lifestyle Center Brædstrup, where patients were given key fobs that mistakenly granted access to the archive room containing the records. This created a potential for unauthorized access to sensitive patient information.

The region itself reported the matter to the Data Protection Agency (Datatilsynet) after discovering the issue in 2020. Immediate action was taken to prevent potentially unauthorized access.

In addition to the key fob error, the judgment also noted that more employees than necessary had access to the archive, and social security numbers were visible through the windows of the room.

While the prosecution sought a fine of 400,000 kroner, the region requested the fine be dropped or a warning be issued. The judge cited the fact that there was only a potential for unauthorized access as a mitigating circumstance, leading to a partial acquittal.

According to Group Director Poul Michaelsen, Region Midtjylland takes data security very seriously and has learned from the mistakes made. He also stated that they are pleased with the clarification the judgment brings.