Did hospital at the centre of Kate medical records scandal wait a week to report ‘hack’? Information Commissioner’s Officer said it took over seven days after Princess was discharged before ‘breach report’ as it is claimed clinic could face ‘£17m fine’

The private hospital at the centre of a scandal around alleged attempts to access the Princess of Wales’s medical records did not report the suspected breach to the authorities for more than seven days after she was discharged, it is claimed.

Three members of staff at The London Clinic are under investigation over claims of a data breach at the clinic, with the trio believed to have been suspended and facing professional sanctions if proven to have accessed her private medical information.

The alleged breach took place at the clinic after the future Queen was admitted for planned abdominal surgery on January 16, with Kate being discharged 14 days later. She has rarely been seen in public since then, leading to cruel conspiracy theories on social media about her wellbeing and health.

It was claimed one member of staff attempted to view her medical records while she was a patient there.

The Information Commissioner’s Office (ICO) is investigating the incident, with reports claiming that part of the probe will look into whether there was a delay in the clinic flagging it them amid claims it took more than a week for a ‘breach report’ to be filed.

Official rules state that any personal data breaches must be reported within 72 hours of their discovery, while data protection rules mean the private hospital could be fined up to £17million if found to have committed wrongdoing, one expert has claimed.

King Charles has also used the clinic in recent months, first for treatment for an enlarged prostate and then after he was diagnosed with cancer. However, his private medical information was not affected by the breach.

The ICO says it is investigating the incident as the clinic itself says it will take ‘all appropriate steps’ to investigate the alleged breach. 

It is believed the police could probe the allegations, with one government minister claiming the Metropolitan Police have been ‘asked to look at it’, although the force says it is not aware of any referral as of yet. 

The CEO of The London Clinic vowed on Wednesday that ‘all appropriate investigatory, regulatory and disciplinary steps will be taken’ as it investigates the data breach claims.

Al Russell, broke his silence yesterday, saying in a statement: ‘Everyone at the London Clinic is acutely aware of our individual, professional, ethical and legal duties with regards to patient confidentiality.

‘We take enormous pride in the outstanding care and discretion we aim to deliver for all our patients that put their trust in us every day.

‘We have systems in place to monitor management of patient information and, in the case of any breach, all appropriate investigatory, regulatory and disciplinary steps will be taken.

‘There is no place at our hospital for those who intentionally breach the trust of any of our patients or colleagues.’

Executives have remained tight-lipped over the nature and extent of the embarrassing breach of private records.

In addition to the alleged breach itself, the ICO is also said to be investigating whether the clinic delayed notifying the watchdog.

Official rules state that any personal data breaches must be reported within 72 hours from their discovery if a risk is posed to a person’s rights or freedoms.

However, reports suggest the ICO did not receive a ‘breach report’ for more than a week after Kate was discharged from the hospital on January 29. 

One source told The Guardian that ‘timeliness of reporting’ was part of its ‘ongoing’ probe into the hospital.

A spokesperson for the clinic told ITV News that they would not comment further other than to say ‘all our patients, no matter what their status, deserve total privacy and confidentiality regarding their personal medical information.

The Princess is said to be aware of the allegations, while a spokesperson for Kensington Palace said: ‘This is a matter for the London Clinic.’

The ICO said on Wednesday: ‘We can confirm that we have received a breach report and are assessing the information provided.’

ONe data protection expert claimed that the Waleses could even sue The London Clinic if the breach is proven to have taken place. 

Iain Wilson, from Brett Wilson LLP, told The Sun: ‘They’ve obviously got obligations to keep medical records secure through the Data Protection Act.

If it is found they didn’t have sufficient systems in place, for instance, they hadn’t trained staff properly, then they could be fined by the information commission officer.

‘A very large sum, I think up to £17.5million or 4 per cent of an organisation’s annual worldwide turnover and potentially sued by the individuals in question.’

He added that the hospital might have had ‘all the training and systems in place’ and the incident took place through a ‘rotten egg’ which is difficult to guard against.

According to the 2018 Data Protection Act, it is an offence to obtain or disclose personal data ‘without the consent of the controller’.

A spokesperson for the General Medical Council, which is the watchdog for doctors, told the Telegraph: ‘Patients must have confidence that their personal information is protected at all times.

‘Our guidance is clear: we expect doctors to make sure any personal information about patients is effectively protected at all times against improper access, disclosure or loss, and they must not access a patient’s personal information unless they have a legitimate reason to view it.’

Jon Baines, a data protection specialist from the law firm Mishcon de Reya, told ITV News: ‘Any investigation by the ICO is likely to consider whether a criminal offence might have been committed by an individual or individuals.’

‘Section 170 of the Data Protection Act 2018 says that a person commits an offence if they obtain or disclose personal data ‘without the consent of the controller’.

‘Here, the ‘controller’ will be the clinic itself.’

While the allegations are being probed by the ICO, it is also claimed that the police could investigated the situation alongside the watchdog.

A source told The Mirror: ‘The IOC will deal with anything as a criminal matter which could end up in a Magistrate’s Court, but if there were further claims of wrongdoing such as a conspiracy to distribute illegally accessed information, then that could be a matter for the police.’

The Metropolitan Police has said it is not aware of any referral to the force regarding the incident at this time.

However, Health Minister Maria Caulfield said she understood ‘police have been asked to look at it’.

Speaking to Sky News, she said the allegations were ‘pretty serious stuff’.

She said: ‘I say this as someone who’s still on the nursing register, that the rules are very, very clear for all patients. That unless you’re looking after that patient, or they’ve given you their consent, you should not be looking at patients’ notes.

‘So there are rules in place and the Information Commissioner can levy fines, that can be prosecutions, your regulator, so as a nurse my regulator would be the NMC (Nursing and Midwifery Council), can take enforcement action… and can strike you off the register if the breach is serious enough.

‘So there are particularly hefty implications if you are looking at notes for medical records that you should not be looking at.’

When asked if the Met Police should also be looking into the matter, she said: ‘My understanding is that police have been asked to look at it – whether they take action is a matter for them.’

Royal experts say Kate has likely been left shocked by the news of the alleged data breach – but will be too busy focusing on her own recovery to let it get to her.

Ingrid Seward, royal biographer and editor-in-chief of Majesty Magazine, told the Mirror the news will have come as ‘a shock to the palace, a shock to the Princess and a shock to her husband and (to her) father-in-law, the King’.

‘For the London Clinic, it is an embarrassment of the worst kind and they will do their best to appease everyone concerned,’ she continued.

But Ms Seward added: ‘As for Catherine it is another emotional upset; she is going to have to put behind her. She is far stronger than she looks. She will not allow her battered emotions to get the better of her.’

Quizzed by reporters on Wednesday, Rishi Sunak’s official spokesman has urged Brits to ‘get behind the Princess of Wales’.

Asked about the alleged breach at the London Clinic, the spokesman said: ‘Clearly there are strict rules on patient data that must be followed.’

And on whether people should give Kate a break, he added: ‘I think we all want to get behind the Princess of Wales, and indeed the Prince of Wales, and we obviously wish her the speediest of recoveries.’

The Princess of Wales has been the subject of a series of cruel conspiracy theories in recent weeks while continuing to recover from surgery she underwent in January.

Online trolls have suggested she is recovering from ‘Brazilian butt lift surgery’ or that she has even been replaced by a body double.

The toxic discourse has been fuelled further by the Mother’s Day photo shared from the Prince and Princess of Wales’ social media accounts earlier this month – after it emerged the picture had been digitally manipulated at source before release.

Global picture agencies including AP, Getty and PA issued a rare ‘kill order’ on the photograph after ruling that it had been manipulated beyond what they considered acceptable journalistic standards.

It had been hoped that footage of Kate walking happily with William outside a farm shop in Windsor at the weekend might have silenced those sharing theories online.

Instead, conspiracy cranks have pored over the footage trying to give weight to their completely unsupported suggestions that she has been replaced by a lookalike, or that the footage itself is old.

Even professional Kate lookalikes have made it clear that they believe it is the Princess herself in the footage – calling for the conspiracy wonks to leave her alone.

Palace sources have fumed at the ‘madness of social media’ as cruel trolls claim to have found ‘proof’ that the princess is more unwell than claimed, or has been replaced with a double.

Kensington Palace has stated since the start of the year that the Princess will not return to public duties until sometime after Easter.

It has not denied that the video of the Princess captured at the weekend is genuine.