Centro Hospitalar Barreiro Montijo, EPE – €400,000 Fine (Portugal, 2018)

What happened

The hospital allowed excessive and inappropriate access to patient records by staff, with more user profiles than actual doctors.

Who was affected

Patients whose sensitive health data was accessed by hospital staff without proper authorization.

What the authority found

The Portuguese data protection authority determined that the hospital failed to limit access to patient data, violating GDPR's data protection principles.

Why this matters

This case highlights the critical need for healthcare institutions to enforce strict access controls and maintain accurate user profiles to protect sensitive data. It warns of the consequences of inadequate data security practices.