The lab report that went to the wrong inbox
A busy front desk picks the wrong email address from autocomplete.
Day 1
At Sunrise Diagnostics, a fictional lab, a receptionist emails a patient's report. Autocomplete picks another patient with the same first name.
Day 2
The wrong recipient replies, upset. She now knows a stranger's diagnosis, and wonders who has seen hers.
Day 3
The owner deletes the email thread and hopes it goes away. There is no breach plan and nobody knows who should report what.
Day 15
The first patient learns of it from the second and complains that nobody told her.
Day 30
The Board asks why the breach was not reported and what safeguards were in place. The lab has no answer on paper.
Day 45
The lab moves reports to a secure patient portal and trains staff, months later than it should have.
The Data Protection Board can impose a penalty up to the maximum the law sets for a breach like this. It weighs each case; nobody can predict the figure. See the penalty categories
What would have prevented it
- Send reports through a secure link or portal instead of open email attachments.
- Keep a written breach plan: who decides, who tells the Board, who tells the patient.
- Collect only what forms need, with a short notice next to each one.
Find out where your website stands
A free, read-only scan with plain-language findings you can act on.