Data leak case a timely reminder

Imagine the shock of enjoying a mini-pancake snack, only to discover it was wrapped in a paper pouch made from a reused patient record — one that specified a diagnosis of hepatitis B.

- 

Fortunately, the incident, which happened last year, did not end with just a loss of appetite. The viral online image of the medical record repurposed as a snack wrapper — a jarring breach of personal data — ultimately produced a significant outcome.

The private hospital responsible was last week fined 1.2 million baht for leaking medical records, classified as “sensitive personal data” under the Personal Data Protection Act (PDPA).

The case serves as a critical reminder for organisations, whether public or private: when it comes to data protection, it is not enough to simply have comprehensive policies in place.

These safeguards must be strictly followed throughout the entire operational chain, especially when outsourcing services.

In this case, the hospital had contracted a small, family-run business to destroy more than 1,000 pages of patient records but failed to monitor the process and ensure it met the required standards, leading to the damaging breach.

The incident offers a valuable lesson for business operators — data protection is not solely about digital security. Physical documents must be handled with the same care to prevent breaches.