{"api":"v1","version":"1.0","asOf":"2026-10-02","dataSha256":"7d9d4873c5fcc598c966c1e0b55dbc9544884e80a4530cefe0af297db25027e5","casesSha256":"f1ec6d86987d31a74727ade9ed7c85e23b8f7a7a9b71897c464d39e886cf36ea","casesAsOf":"2026-10-07","license":{"id":"CC-BY-4.0","url":"https://creativecommons.org/licenses/by/4.0/","credit":"SuperTruth, Inc., Health Record Rights Index","covers":"Our scores, summaries, ratings, labels and the structure of this data.","excludes":"Not relicensed: words quoted from laws and other sources, the titles of third-party pages, and the pages those links point to. They belong to their owners."},"citation":"Snyder, J. A., Hill, R. P., IV, Raney, D., & Sims, L. (2026). Health Record Rights Index (version 1.0). SuperTruth Inc. https://healthrecordrights.com/ https://doi.org/10.5281/zenodo.23120174","pageUrl":"https://healthrecordrights.com/real-cases/","data":{"count":442,"howToCite":"Health Record Rights Index, real case {id} (our summary of a report by {source}, {date}), {pageUrl}, cases as of {casesAsOf}. Original: {url}. A summary is ours, never anyone's words: do not put it in quotation marks. Never use the cases to say how common a problem is.","cases":[{"iso3":"ALB","country":"Albania","date":"2026-08-24","headline":"Regulator steps in after clinic ignores a patient's request for their file","paraphrase":"A patient asked a private clinic for all the records it held on them and got no reply. After a complaint, inspectors visited, the clinic produced the file and undertook to supply it, and the regulator ordered fixes.","source":"Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale (IDP)","url":"https://idp.al/wp-content/uploads/2026/09/Rekomandim-Nr.-55-Viti-2026-DPM.pdf","archiveUrl":"https://web.archive.org/web/20261005153703/https://idp.al/wp-content/uploads/2026/09/Rekomandim-Nr.-55-Viti-2026-DPM.pdf","theme":"access_refused","status":"finding","id":"ALB-S001","pageUrl":"https://healthrecordrights.com/real-cases/#ALB-S001","countryUrl":"https://healthrecordrights.com/brief/albania/","why":"The legal right to see your own record only worked once the regulator sent inspectors.","sourceType":"regulator_decision","lang":"sq","providerName":"Akesios Dent (Akesios Dental Beauty)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ALB","country":"Albania","date":"2026-02-26","headline":"Medical laboratory fined for weak safeguards on patient data","paraphrase":"Months after a regulator recommendation, a medical laboratory still had no data protection terms with firms handling patient data for it and an incomplete security system. The regulator fined it ALL 2.8 million.","source":"Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale (IDP)","url":"https://idp.al/wp-content/uploads/2026/03/Vendim-Nr.-8-Viti-2026-DPM.pdf","theme":"other","status":"finding","id":"ALB-S002","pageUrl":"https://healthrecordrights.com/real-cases/#ALB-S002","countryUrl":"https://healthrecordrights.com/brief/albania/","why":"Patient data passed to outside firms with no written rules on how they must protect it.","sourceType":"regulator_decision","lang":"sq","providerName":"Cambridge Clinical Laboratories","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ALB","country":"Albania","date":"2024-11-21","headline":"Ransomware locks a public hospital's data and halts scans and lab tests","paraphrase":"Ransomware encrypted all of a regional public hospital's data, stopping imaging and blood testing until services returned within 72 hours. The report says some patient data was deleted. The hospital confirmed the attack.","source":"Faktoje.al","url":"https://faktoje.al/terrorizmi-kibernetik-i-korese-se-veriut-ndaj-spitalit-memorial-te-fierit-dhe-rreziku-i-ekspozimit-te-spitaleve-publike-ndaj-ketyre-sulmeve/","archiveUrl":"https://web.archive.org/web/20261005153909/https://faktoje.al/terrorizmi-kibernetik-i-korese-se-veriut-ndaj-spitalit-memorial-te-fierit-dhe-rreziku-i-ekspozimit-te-spitaleve-publike-ndaj-ketyre-sulmeve/","theme":"breach","status":"admitted","id":"ALB-S003","pageUrl":"https://healthrecordrights.com/real-cases/#ALB-S003","countryUrl":"https://healthrecordrights.com/brief/albania/","why":"A cyberattack cut patients off from their own test results and imaging for days.","sourceType":"journalism","lang":"sq","providerName":"Spitali Rajonal Memorial i Fierit","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"DZA","country":"Algeria","date":"2025-01-14","headline":"Laboratory reported an alarming result that two later tests did not confirm","paraphrase":"A patient told El Watan that a first laboratory reported an alarming test result. Repeat tests at two other laboratories did not confirm it, and she concluded the first result was an error.","source":"El Watan","url":"https://elwatan.dz/les-analyses-medicales-la-controverse-les-resultats-peuvent-varier-dun-laboratoire-a-un-autre/","archiveUrl":"https://web.archive.org/web/20261005164628/https://elwatan.dz/les-analyses-medicales-la-controverse-les-resultats-peuvent-varier-dun-laboratoire-a-un-autre/","theme":"record_wrong","status":"alleged","id":"DZA-S001","pageUrl":"https://healthrecordrights.com/real-cases/#DZA-S001","countryUrl":"https://healthrecordrights.com/brief/algeria/","why":"A wrong test result in the record can drive needless fear and treatment decisions.","sourceType":"journalism","lang":"fr","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AND","country":"Andorra","date":"2025-09-03","headline":"Data regulator rebukes two private clinics for passing patient files without consent","paraphrase":"Acting on one person's complaint, the data protection authority found that a closing clinic handed clinical files to another clinic without consent or notice, and that both lacked safeguards. It warned both and ordered proof of compliance.","source":"Diari d'Andorra","url":"https://www.diariandorra.ad/nacional/250903/amonestats-dos-centres-psicologia-per-cedir-dades-cliniques-forma-irregular_179510.html","archiveUrl":"https://web.archive.org/web/20261005153933/https://www.diariandorra.ad/nacional/250903/amonestats-dos-centres-psicologia-per-cedir-dades-cliniques-forma-irregular_179510.html","theme":"sold_or_shared","status":"finding","id":"AND-S001","pageUrl":"https://healthrecordrights.com/real-cases/#AND-S001","countryUrl":"https://healthrecordrights.com/brief/andorra/","why":"Patients must be told and asked before their clinical files move to another provider, even when a practice closes.","sourceType":"journalism","lang":"ca","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AND","country":"Andorra","date":"2024-10-31","headline":"Doctors say patient files became hard to find after national record system update","paraphrase":"Several doctors told the newspaper that after a software update to the national shared record, some patients' files could not be found and some entries did not match earlier data, lengthening waits. The operator said the system worked normally.","source":"Diari d'Andorra","url":"https://www.diariandorra.ad/nacional/241031/historial-clinic-caotic_160930.html","archiveUrl":"https://web.archive.org/web/20261005154032/https://www.diariandorra.ad/nacional/241031/historial-clinic-caotic_160930.html","theme":"other","status":"alleged","id":"AND-S002","pageUrl":"https://healthrecordrights.com/real-cases/#AND-S002","countryUrl":"https://healthrecordrights.com/brief/andorra/","why":"When a shared record system changes, missing or mismatched entries can delay care and leave gaps in a patient's history.","sourceType":"journalism","lang":"ca","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AGO","country":"Angola","date":"2025-12-20","headline":"Hospital chiefs say unlinked systems make patients repeat registrations and tests between hospitals","paraphrase":"Hospital directors and the national hospitals director said there is no single health information system, so a patient may be registered several times, exams are repeated, and transfers between hospitals happen without the patient's information reaching the receiving team.","source":"Correio da Kianda","url":"https://correiokianda.info/ausencia-de-sistema-informatico-de-saude-coloca-em-risco-vida-dos-pacientes/","archiveUrl":"https://web.archive.org/web/20261005153636/https://correiokianda.info/ausencia-de-sistema-informatico-de-saude-coloca-em-risco-vida-dos-pacientes/","theme":"lost_between_providers","status":"admitted","id":"AGO-S001","pageUrl":"https://healthrecordrights.com/real-cases/#AGO-S001","countryUrl":"https://healthrecordrights.com/brief/angola/","why":"When hospitals cannot share a patient's record, people are registered again, retested and sent on without their history.","sourceType":"journalism","lang":"pt","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ATG","country":"Antigua and Barbuda","date":"2025-11-27","headline":"Patient says private clinic never handed over her records despite repeated requests","paraphrase":"In a court claim reported by the outlet, a patient alleges that she asked a private clinic several times for her medical records and never received them. No defence had been filed.","source":"Antigua.news","url":"https://antigua.news/2025/11/27/antiguan-woman-sues-dr-joey-john-after-years-of-pain-following-2020-operation/","archiveUrl":"https://web.archive.org/web/20261005154428/https://antigua.news/2025/11/27/antiguan-woman-sues-dr-joey-john-after-years-of-pain-following-2020-operation/","theme":"access_refused","status":"alleged","id":"ATG-S001","pageUrl":"https://healthrecordrights.com/real-cases/#ATG-S001","countryUrl":"https://healthrecordrights.com/brief/antigua-and-barbuda/","why":"Without their own records, patients seeking a second opinion abroad must start again and cannot check what was done.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ATG","country":"Antigua and Barbuda","date":"2025-09-02","headline":"Family alleges state hospital staff falsified records to extend a patient's stay","paraphrase":"A formal complaint to the Ministry of Health alleges that staff at a public hospital falsified a patient's records to justify keeping her longer. The Ministry opened an internal review and has not published findings.","source":"Antigua.news","url":"https://antigua.news/2025/09/02/investigation-launched-into-alleged-mistreatment-of-u-s-medical-student-at-clarevue/","archiveUrl":"https://web.archive.org/web/20261005154547/https://antigua.news/2025/09/02/investigation-launched-into-alleged-mistreatment-of-u-s-medical-student-at-clarevue/","theme":"record_wrong","status":"alleged","id":"ATG-S002","pageUrl":"https://healthrecordrights.com/real-cases/#ATG-S002","countryUrl":"https://healthrecordrights.com/brief/antigua-and-barbuda/","why":"A false entry in a record can be used to keep a person in care longer; patients need a way to see and challenge it.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ATG","country":"Antigua and Barbuda","date":"2026-04-04","headline":"Fire at a medical building destroys years of patient records at six practices","paraphrase":"The national medical association said a fire at a shared medical building destroyed the offices, equipment and years of patient records of six doctors' practices, a loss it called a blow to the patients who rely on them.","source":"Antigua.news (statement of the Medical Association of Antigua and Barbuda)","url":"https://antigua.news/2026/04/04/statement-from-the-medical-association-of-antigua-and-barbuda-inc-regarding-the-devastating-fire-affecting-local-doctors/","archiveUrl":"https://web.archive.org/web/20261005154545/https://antigua.news/2026/04/04/statement-from-the-medical-association-of-antigua-and-barbuda-inc-regarding-the-devastating-fire-affecting-local-doctors/","theme":"other","status":"alleged","id":"ATG-S003","pageUrl":"https://healthrecordrights.com/real-cases/#ATG-S003","countryUrl":"https://healthrecordrights.com/brief/antigua-and-barbuda/","why":"Paper-only records kept in one place can vanish at once, leaving patients with no history for their next doctor.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ARG","country":"Argentina","date":"2024-12-03","headline":"Cyberattack locked databases at three medical testing centres, delaying patients' results","paraphrase":"A ransomware attack encrypted the shared databases of three large testing and laboratory centres, affecting thousands of patients for ten days. The group said no patient data was taken, but labs closed and reports were handed out manually.","source":"La Nación","url":"https://www.lanacion.com.ar/sociedad/estamos-haciendo-el-maximo-esfuerzo-para-resolverlo-hackearon-el-servidor-de-tres-importantes-nid02122024/","archiveUrl":"https://web.archive.org/web/20261005154221/https://www.lanacion.com.ar/sociedad/estamos-haciendo-el-maximo-esfuerzo-para-resolverlo-hackearon-el-servidor-de-tres-importantes-nid02122024/","theme":"access_delay_or_cost","status":"admitted","id":"ARG-S001","pageUrl":"https://healthrecordrights.com/real-cases/#ARG-S001","countryUrl":"https://healthrecordrights.com/brief/argentina/","why":"When a provider's systems are held to ransom, patients can be cut off from their own results for days.","sourceType":"journalism","lang":"es","providerName":"Grupo Rossi (Centro Rossi, Stamboulian, Laboratorio Hidalgo)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ARG","country":"Argentina","date":"2025-04-05","headline":"Hackers offer 665,128 patients' test results for sale after attack on software supplier","paraphrase":"Criminals put up for sale 665,128 medical test results with patients' personal details, taken from a company that stores imaging for about 30 clinics and hospitals in several provinces. After extortion failed, the data went on sale.","source":"Tiempo Argentino","url":"https://www.tiempoar.com.ar/ta_article/hackean-665-128-estudios-medicos-la-filtracion-de-datos-de-salud-mas-grande-del-pais/","archiveUrl":"https://web.archive.org/web/20261005154239/https://www.tiempoar.com.ar/ta_article/hackean-665-128-estudios-medicos-la-filtracion-de-datos-de-salud-mas-grande-del-pais/","theme":"breach","status":"alleged","id":"ARG-S002","pageUrl":"https://healthrecordrights.com/real-cases/#ARG-S002","countryUrl":"https://healthrecordrights.com/brief/argentina/","why":"Results stored by a clinic's software supplier can leak even when the clinic itself was not attacked.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ARG","country":"Argentina","date":"2026-05-15","headline":"Lawmaker seeks answers over claimed sale of millions of Argentines' health records","paraphrase":"Attackers claimed to be selling 700 GB from a national government health database, including clinical records and personal details of up to 52 million people. A national deputy filed requests for information. The leak was unconfirmed.","source":"Código Baires","url":"https://www.codigobaires.com.ar/2026-05-15/denuncian-filtracion-y-la-venta-de-historias-clinicas-y-datos-sensibles-de-52-millones-de-argentinos-248315","archiveUrl":"https://web.archive.org/web/20261005154417/https://www.codigobaires.com.ar/2026-05-15/denuncian-filtracion-y-la-venta-de-historias-clinicas-y-datos-sensibles-de-52-millones-de-argentinos-248315","theme":"breach","status":"alleged","id":"ARG-S003","pageUrl":"https://healthrecordrights.com/real-cases/#ARG-S003","countryUrl":"https://healthrecordrights.com/brief/argentina/","why":"A claimed leak of a national health database could expose clinical records of nearly everyone in the country.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ARG","country":"Argentina","date":"2026-05-23","headline":"Retirees' insurer posted members' clinical records on its public purchasing site","paraphrase":"A fact-checking investigation found at least 40 purchase files on the insurer's public procurement search showing members' clinical histories, test results and ID copies. The insurer called it a serious anomaly, removed the files and opened internal inquiries.","source":"Jujuygráfico","url":"https://jujuygrafico.com.ar/pami-historias-clinicas-jubilados-jujuy-gob","archiveUrl":"https://web.archive.org/web/20261005191704/https://jujuygrafico.com.ar/pami-historias-clinicas-jubilados-jujuy-gob","theme":"breach","status":"admitted","id":"ARG-S004","pageUrl":"https://healthrecordrights.com/real-cases/#ARG-S004","countryUrl":"https://healthrecordrights.com/brief/argentina/","why":"Files uploaded to approve a purchase exposed full clinical histories and ID copies to anyone online.","sourceType":"journalism","lang":"es","providerName":"PAMI (INSSJP)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ARM","country":"Armenia","date":"2025-09-10","headline":"Former doctors allege a regional hospital recorded patients who were never treated","paraphrase":"Former doctors told investigative reporters that hospital management entered names of people who were not ill as state-funded patients, inflating patient numbers. The health ministry referred the claims to anti-corruption investigators; management called them absurd.","source":"Hetq","url":"https://hetq.am/hy/article/176726","archiveUrl":"https://web.archive.org/web/20261005154402/https://hetq.am/hy/article/176726","theme":"record_wrong","status":"alleged","id":"ARM-S001","pageUrl":"https://healthrecordrights.com/real-cases/#ARM-S001","countryUrl":"https://healthrecordrights.com/brief/armenia/","why":"Records listing care that never happened can corrupt a person's health history and misdirect public money.","sourceType":"journalism","lang":"hy","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AUS","country":"Australia","date":"2026-08-14","headline":"AI note-taker put a false statement into a patient's specialist letter","paraphrase":"A patient agreed to have a specialist appointment transcribed by an AI tool. She later found a letter to her GP claimed something she says she never said. After she complained, the specialist apologised and corrected it.","source":"ABC News","url":"https://www.abc.net.au/news/2026-08-14/ai-medical-scribe-error-leaves-patient-devastated/107031672","archiveUrl":"https://web.archive.org/web/20261005154700/https://www.abc.net.au/news/2026-08-14/ai-medical-scribe-error-leaves-patient-devastated/107031672","theme":"record_wrong","status":"alleged","id":"AUS-S001","pageUrl":"https://healthrecordrights.com/real-cases/#AUS-S001","countryUrl":"https://healthrecordrights.com/brief/australia/","why":"AI scribes can write things a patient never said into the record that other doctors then rely on.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AUS","country":"Australia","date":"2026-07-22","headline":"Another woman's hospital history merged into a patient's record; family told she died","paraphrase":"Another woman's appointments and tests were added to a patient's health record. When the other woman died, police wrongly told the patient's family that the patient had died. Mercy Health apologised.","source":"ABC News","url":"https://www.abc.net.au/news/2026-07-22/mistaken-identity-data-hospital-error-death-notice-police/106936454","archiveUrl":"https://web.archive.org/web/20261005154755/https://www.abc.net.au/news/2026-07-22/mistaken-identity-data-hospital-error-death-notice-police/106936454","theme":"record_wrong","status":"admitted","id":"AUS-S002","pageUrl":"https://healthrecordrights.com/real-cases/#AUS-S002","countryUrl":"https://healthrecordrights.com/brief/australia/","why":"A mixed-up identity in a hospital record can spread to the national record and to police.","sourceType":"journalism","lang":"en","providerName":"Mercy Health","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AUS","country":"Australia","date":"2025-11-21","headline":"Tribunal finds doctor passed a patient's record details to someone she needed protection from","paraphrase":"A doctor in Western Australia repeatedly opened a patient's records and passed details to a person the patient had a restraining order against. The State Administrative Tribunal found misconduct and the doctor was deregistered.","source":"ABC News","url":"https://www.abc.net.au/news/2025-11-21/perth-doctor-suspended-for-patient-confidentiality-breach/106034508","archiveUrl":"https://web.archive.org/web/20261005154848/https://www.abc.net.au/news/2025-11-21/perth-doctor-suspended-for-patient-confidentiality-breach/106034508","theme":"breach","status":"finding","id":"AUS-S003","pageUrl":"https://healthrecordrights.com/real-cases/#AUS-S003","countryUrl":"https://healthrecordrights.com/brief/australia/","why":"A doctor's access to records can be misused to help someone a patient is trying to stay safe from.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AUS","country":"Australia","date":"2026-06-30","headline":"Former patients still locked out of their records months after clinic closed","paraphrase":"A general practice in regional Victoria closed without warning. More than five months later its former patients still could not get their medical records, which remained under the closed practice's control while health agencies sought a fix.","source":"South Gippsland Sentinel-Times","url":"https://www.sgst.com.au/leongatha-patients-still-locked-out-of-medical-records/","archiveUrl":"https://web.archive.org/web/20261005154945/https://www.sgst.com.au/leongatha-patients-still-locked-out-of-medical-records/","theme":"lost_between_providers","status":"alleged","id":"AUS-S004","pageUrl":"https://healthrecordrights.com/real-cases/#AUS-S004","countryUrl":"https://healthrecordrights.com/brief/australia/","why":"When a practice shuts without warning, patients' records can stay out of reach while agencies sort out who holds them.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AUS","country":"Australia","date":"2026-03-10","headline":"Minister's office accused of giving a patient's health details to journalists","paraphrase":"After a South Australian patient spoke publicly about her care, the state health minister's office shared confidential details about her with journalists, the opposition claimed. She says she did not consent.","source":"InDaily (South Australia)","url":"https://www.indailysa.com.au/news/just-in/2026/03/10/second-labor-govt-patient-information-leak-liberals-claim","archiveUrl":"https://web.archive.org/web/20261005155006/https://www.indailysa.com.au/news/just-in/2026/03/10/second-labor-govt-patient-information-leak-liberals-claim","theme":"sold_or_shared","status":"alleged","id":"AUS-S005","pageUrl":"https://healthrecordrights.com/real-cases/#AUS-S005","countryUrl":"https://healthrecordrights.com/brief/australia/","why":"Health details given to the press without consent can follow a patient who speaks up about her care.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AUT","country":"Austria","date":"2025-10-20","headline":"Hospital security manager copied a patient's record and emailed it to police","paraphrase":"A patient learned during a court case that a hospital report about them had reached third parties. The regulator found the hospital's security manager had copied the electronic record and emailed it to police. The court upheld that finding.","source":"Federal Administrative Court (Bundesverwaltungsgericht), W108 2276075-1, upholding a Datenschutzbehörde decision","url":"https://www.ris.bka.gv.at/Dokumente/Bvwg/BVWGT_20251020_W108_2276075_1_00/BVWGT_20251020_W108_2276075_1_00.html","archiveUrl":"https://web.archive.org/web/20261005155027/https://www.ris.bka.gv.at/Dokumente/Bvwg/BVWGT_20251020_W108_2276075_1_00/BVWGT_20251020_W108_2276075_1_00.html","theme":"sold_or_shared","status":"finding","id":"AUT-S001","pageUrl":"https://healthrecordrights.com/real-cases/#AUT-S001","countryUrl":"https://healthrecordrights.com/brief/austria/","why":"Staff with system access can pull a whole record and send it outside the hospital without the patient's consent.","sourceType":"court_judgment","lang":"de","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AUT","country":"Austria","date":"2025-08-21","headline":"Doctor opened a person's national e-health record without consent; regulator fined her","paraphrase":"A woman found through the ELGA access log that a doctor had opened her stored results and medication data without consent and unconnected to any treatment by that doctor. The regulator found a violation and imposed a 1,000 euro fine.","source":"Datenschutzbehörde (Austrian Data Protection Authority), penal decision 2025-0.625.944","url":"https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20250821_2025_0_625_944_00/DSBT_20250821_2025_0_625_944_00.html","theme":"breach","status":"finding","id":"AUT-S002","pageUrl":"https://healthrecordrights.com/real-cases/#AUT-S002","countryUrl":"https://healthrecordrights.com/brief/austria/","why":"ELGA access logs let a patient see who looked; here they showed a doctor reading results she had no right to see.","sourceType":"regulator_decision","lang":"de","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"AUT","country":"Austria","date":"2026-01-09","headline":"Therapy centre left handwritten notes out of a patient's access request","paraphrase":"A patient asked a therapy centre for all data held about them. The centre left out notes a staff member kept by hand. The regulator found this breached the right of access and ordered full disclosure within four weeks.","source":"Datenschutzbehörde (Austrian Data Protection Authority), decision 2026-0.018.391","url":"https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20260109_2026_0_018_391_00/DSBT_20260109_2026_0_018_391_00.html","archiveUrl":"https://web.archive.org/web/20261005155143/https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20260109_2026_0_018_391_00/DSBT_20260109_2026_0_018_391_00.html","theme":"access_refused","status":"finding","id":"AUT-S003","pageUrl":"https://healthrecordrights.com/real-cases/#AUT-S003","countryUrl":"https://healthrecordrights.com/brief/austria/","why":"Paper notes count as part of your data; a provider cannot leave them out because they are not on a computer.","sourceType":"regulator_decision","lang":"de","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AZE","country":"Azerbaijan","date":"2026-08-01","headline":"Footage of a patient's care posted online as advertising, report says","paraphrase":"A report says a doctor at a clinic filmed a patient during care and posted it as an advertisement. A physician called publishing such footage without consent a breach of medical secrecy.","source":"Baku.ws","url":"https://baku.ws/ru/obschestvo/tancy-so-skalpelem-skandalnoe-video-operacii-radi-trendov-v-baku","archiveUrl":"https://web.archive.org/web/20261005155234/https://baku.ws/ru/obschestvo/tancy-so-skalpelem-skandalnoe-video-operacii-radi-trendov-v-baku","theme":"breach","status":"alleged","id":"AZE-S001","pageUrl":"https://healthrecordrights.com/real-cases/#AZE-S001","countryUrl":"https://healthrecordrights.com/brief/azerbaijan/","why":"Footage of care is part of a patient's confidential record; publishing it without consent exposes the patient.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AZE","country":"Azerbaijan","date":"2025-06-04","headline":"Doctor shared revealing images of a patient taken during care, outlet reports","paraphrase":"An outlet reports that a doctor posted video taken during care that showed a patient's body uncovered. The posting drew public criticism over patient confidentiality.","source":"Bizim.Media","url":"https://bizim.media/az/cemiyyet/253017/bakida-hekim-pasiyentin-sinesinin-goruntulerini-yayimlayib-reqs-etdi-ndash-vdeo/","archiveUrl":"https://web.archive.org/web/20261005155255/https://bizim.media/az/cemiyyet/253017/bakida-hekim-pasiyentin-sinesinin-goruntulerini-yayimlayib-reqs-etdi-ndash-vdeo/","theme":"breach","status":"alleged","id":"AZE-S002","pageUrl":"https://healthrecordrights.com/real-cases/#AZE-S002","countryUrl":"https://healthrecordrights.com/brief/azerbaijan/","why":"Images taken during care belong to the patient's confidential record; sharing them publicly exposes the patient.","sourceType":"journalism","lang":"az","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"AZE","country":"Azerbaijan","date":"2025-03-06","headline":"Private clinic laboratory issued a wrong test result to a patient, outlet reports","paraphrase":"An outlet reports that a private clinic's laboratory gave a patient an incorrect negative test result. The Ministry of Health responded that screening results outside the specialist centre must be confirmed there.","source":"News24.az","url":"https://news24.az/196275-pasiyente-yanlish-diaqnoz-qoyuldu.html","archiveUrl":"https://web.archive.org/web/20261005155334/https://news24.az/196275-pasiyente-yanlish-diaqnoz-qoyuldu.html","theme":"record_wrong","status":"alleged","id":"AZE-S003","pageUrl":"https://healthrecordrights.com/real-cases/#AZE-S003","countryUrl":"https://healthrecordrights.com/brief/azerbaijan/","why":"A wrong result in a patient's record can mislead every clinician who relies on it later.","sourceType":"journalism","lang":"az","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BHS","country":"Bahamas","date":"2025-11-12","headline":"Patient waits nearly three months for own hospital records after paying the fee","paraphrase":"A patient said she applied for her own hospital records and paid the fee, but nearly three months later still had not received them, stalling an official application. She alleged staff help faster if tipped.","source":"The Tribune (Nassau)","url":"https://www.tribune242.com/news/2025/nov/12/pmh-patients-detail-long-waits-poor-conditions/","archiveUrl":"https://web.archive.org/web/20261005160106/https://www.tribune242.com/news/2025/nov/12/pmh-patients-detail-long-waits-poor-conditions/","theme":"access_delay_or_cost","status":"alleged","id":"BHS-S001","pageUrl":"https://healthrecordrights.com/real-cases/#BHS-S001","countryUrl":"https://healthrecordrights.com/brief/bahamas/","why":"A paid request for your own record can stall for months, holding up official applications that depend on it.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BHR","country":"Bahrain","date":"2026-09-21","headline":"Data protection authority fines medical centre for emailing patient test results to employer","paraphrase":"After a citizen complained, the Personal Data Protection Authority found a medical centre had emailed information and a document about his medical tests to his employer without valid prior consent or legal basis, and fined it 1,000 dinars.","source":"Akhbar Al Khaleej","url":"https://akhbar-alkhaleej.com/news/article/1451221","archiveUrl":"https://web.archive.org/web/20261005160022/https://akhbar-alkhaleej.com/news/article/1451221","theme":"sold_or_shared","status":"finding","id":"BHR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#BHR-S001","countryUrl":"https://healthrecordrights.com/brief/bahrain/","why":"Health details sent to an employer without consent can affect a person's job; the regulator treated it as a breach of law.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BHR","country":"Bahrain","date":"2026-03-15","headline":"Ransomware group claims it stole 110 GB of data from a private hospital","paraphrase":"A ransomware group listed a private hospital on its leak site, claimed to hold 110 GB of its data, posted images of systems it said it had accessed, and threatened to publish the data unless paid.","source":"Security Affairs","url":"https://securityaffairs.com/189467/cyber-crime/payload-ransomware-claims-the-hack-of-royal-bahrain-hospital.html","archiveUrl":"https://web.archive.org/web/20261005160047/https://securityaffairs.com/189467/cyber-crime/payload-ransomware-claims-the-hack-of-royal-bahrain-hospital.html","theme":"breach","status":"alleged","id":"BHR-S002","pageUrl":"https://healthrecordrights.com/real-cases/#BHR-S002","countryUrl":"https://healthrecordrights.com/brief/bahrain/","why":"One stolen hospital archive can expose records of patients from across the Gulf at once.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BGD","country":"Bangladesh","date":"2026-04-18","headline":"Diagnostic centre apologises after scan report carried contradictory entries","paraphrase":"A patient's scan report from a diagnostic centre contained entries that contradicted each other, and a doctor reading it gave alarming advice. A repeat test elsewhere found nothing wrong. The centre apologised in writing.","source":"Sangbad Sarabela","url":"https://www.sangbadsarabela.com/country/article/82056","archiveUrl":"https://web.archive.org/web/20261005155549/https://www.sangbadsarabela.com/country/article/82056","theme":"record_wrong","status":"admitted","id":"BGD-S001","pageUrl":"https://healthrecordrights.com/real-cases/#BGD-S001","countryUrl":"https://healthrecordrights.com/brief/bangladesh/","why":"A self-contradicting report led another doctor to give alarming advice; patients need reports they can trust.","sourceType":"journalism","lang":"bn","providerName":"Shahjalal Diagnostic Centre","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BGD","country":"Bangladesh","date":"2026-07-24","headline":"Diagnostic centre admits an X-ray report wrongly said normal","paraphrase":"A patient's X-ray report described the image as normal although a specialist saw clear signs of injury on the film. The diagnostic centre admitted the error, saying it happened while reports were obtained remotely by email.","source":"Ajker Patrika","url":"https://www.ajkerpatrika.com/bangladesh/tangail/ajphkxkolghxk","archiveUrl":"https://web.archive.org/web/20261005155610/https://www.ajkerpatrika.com/bangladesh/tangail/ajphkxkolghxk","theme":"record_wrong","status":"admitted","id":"BGD-S002","pageUrl":"https://healthrecordrights.com/real-cases/#BGD-S002","countryUrl":"https://healthrecordrights.com/brief/bangladesh/","why":"A report that contradicts the image can steer treatment the wrong way; the centre blamed remote reporting.","sourceType":"journalism","lang":"bn","providerName":"Popular Diagnostic Centre","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BGD","country":"Bangladesh","date":"2025-09-13","headline":"Health directorate bans drug company representatives from photographing patients' prescriptions","paraphrase":"The national health directorate told government hospitals that pharmaceutical sales representatives may no longer photograph prescriptions, patient information or hospital documents, and warned of legal action against anyone who breaks the rule.","source":"The Business Standard","url":"https://www.tbsnews.net/bangladesh/health/pharma-reps-allowed-2-days-week-govt-hospitals-no-photographing-prescriptions-dghs","archiveUrl":"https://web.archive.org/web/20261005155639/https://www.tbsnews.net/bangladesh/health/pharma-reps-allowed-2-days-week-govt-hospitals-no-photographing-prescriptions-dghs","theme":"sold_or_shared","status":"alleged","id":"BGD-S003","pageUrl":"https://healthrecordrights.com/real-cases/#BGD-S003","countryUrl":"https://healthrecordrights.com/brief/bangladesh/","why":"Patients' prescriptions and details were being photographed by sales staff; the regulator had to forbid it.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BGD","country":"Bangladesh","date":"2026-06-17","headline":"Family complains that a clinic's normal scan report missed a serious problem","paraphrase":"A patient's family filed a complaint that a clinic's scan report said normal, while three later scans at other centres found a serious problem. The clinic stood by its report; the local health officer promised an investigation.","source":"Daily Naya Diganta","url":"https://dailynayadiganta.com/bangladesh/country-news/r4vxfqJu6juS","archiveUrl":"https://web.archive.org/web/20261005155813/https://dailynayadiganta.com/bangladesh/country-news/r4vxfqJu6juS","theme":"record_wrong","status":"alleged","id":"BGD-S004","pageUrl":"https://healthrecordrights.com/real-cases/#BGD-S004","countryUrl":"https://healthrecordrights.com/brief/bangladesh/","why":"A wrong normal result delayed the right diagnosis; the local health office said it would investigate.","sourceType":"journalism","lang":"bn","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BLR","country":"Belarus","date":"2025-04-07","headline":"Private clinic sent a patient a wrong test report, regulator and court confirmed","paraphrase":"A clinic emailed a patient a lab report with a serious finding that was false. The city health committee confirmed a template error and reprimanded the doctor; the clinic apologised and a court awarded damages.","source":"Onliner (people.onliner.by)","url":"https://people.onliner.by/2025/04/07/diagnoz-no-ne-tot","archiveUrl":"https://web.archive.org/web/20261005160356/https://people.onliner.by/2025/04/07/diagnoz-no-ne-tot","theme":"record_wrong","status":"finding","id":"BLR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#BLR-S001","countryUrl":"https://healthrecordrights.com/brief/belarus/","why":"One wrong template in a report sent a patient into weeks of needless tests; only her own push for a recheck caught it.","sourceType":"journalism","lang":"ru","providerName":"Evaclinic (Radi zhenshchin)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BLR","country":"Belarus","date":"2025-11-13","headline":"Patient suing a private clinic says it would not hand over her records","paraphrase":"A patient in a damages case says a private clinic refused her copies of her medical and anaesthesia records. A video of the procedure turned out to be deleted, and its documents gave conflicting figures.","source":"Onliner (people.onliner.by)","url":"https://people.onliner.by/2025/11/13/sud-po-plasticheskoj-operacii","theme":"access_refused","status":"alleged","id":"BLR-S002","pageUrl":"https://healthrecordrights.com/real-cases/#BLR-S002","countryUrl":"https://healthrecordrights.com/brief/belarus/","why":"Without copies of your own file and the clinic's recordings, a patient cannot check what happened or argue a claim.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"BLR","country":"Belarus","date":"2026-02-23","headline":"Patient released from detention sent home without any discharge summary or medical papers","paraphrase":"A patient released from detention came home with no discharge summary or extract from his records. His family said this made it hard to arrange prompt follow-up care.","source":"Current Time (Nastoyashchee Vremya)","url":"https://www.currenttime.tv/a/belarus-statkevich/33685224.html","archiveUrl":"https://web.archive.org/web/20261005160528/https://www.currenttime.tv/a/belarus-statkevich/33685224.html","theme":"lost_between_providers","status":"alleged","id":"BLR-S003","pageUrl":"https://healthrecordrights.com/real-cases/#BLR-S003","countryUrl":"https://healthrecordrights.com/brief/belarus/","why":"When records stay behind at release, the next doctor starts blind and urgent care is slowed.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BEL","country":"Belgium","date":"2025-12-18","headline":"Access list showed a therapist opened a patient's test results without a care reason","paraphrase":"A patient asked her hospital group who had opened her electronic record. The list showed a therapist working there had viewed her test results three times. The regulator reprimanded the hospital for weak access controls; an appeal is pending.","source":"Gegevensbeschermingsautoriteit (Belgian Data Protection Authority), Litigation Chamber decision 209/2025","url":"https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-209-2025.pdf","archiveUrl":"https://web.archive.org/web/20261005155354/https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-209-2025.pdf","theme":"breach","status":"finding","id":"BEL-S001","pageUrl":"https://healthrecordrights.com/real-cases/#BEL-S001","countryUrl":"https://healthrecordrights.com/brief/belgium/","why":"Asking who opened your record is how this patient found out; the hospital lacked controls to stop it.","sourceType":"regulator_decision","lang":"nl","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BEL","country":"Belgium","date":"2024-12-17","headline":"Ransomware hit a hospital whose patient record system had weak password protection","paraphrase":"An attacker locked a hospital's servers and exported about 5 gigabytes of data. The regulator found security failings, including weak protection of access to the electronic patient record, and fined the hospital 390,000 euros. An appeal court later reduced it.","source":"Gegevensbeschermingsautoriteit (Belgian Data Protection Authority), Litigation Chamber decision 166/2024","url":"https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-166-2024.pdf","archiveUrl":"https://web.archive.org/web/20261005155409/https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-166-2024.pdf","theme":"breach","status":"finding","id":"BEL-S002","pageUrl":"https://healthrecordrights.com/real-cases/#BEL-S002","countryUrl":"https://healthrecordrights.com/brief/belgium/","why":"Patients' records depend on basic security at the hospital; the regulator found it missing here.","sourceType":"regulator_decision","lang":"nl","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BEL","country":"Belgium","date":"2024-10-04","headline":"Hackers took 53,900 sick-leave check files including doctors' comments","paraphrase":"A company that runs employer-requested sick-leave checks said hackers had taken 53,900 files, including names, addresses, incapacity levels and examining doctors' comments, and published them a week later. It warned of phishing using the data.","source":"RTBF","url":"https://www.rtbf.be/article/la-societe-medicheck-informe-que-des-hackers-ont-mis-la-main-sur-53-900-dossiers-de-medecins-controle-11444168","archiveUrl":"https://web.archive.org/web/20261005155428/https://www.rtbf.be/article/la-societe-medicheck-informe-que-des-hackers-ont-mis-la-main-sur-53-900-dossiers-de-medecins-controle-11444168","theme":"breach","status":"admitted","id":"BEL-S004","pageUrl":"https://healthrecordrights.com/real-cases/#BEL-S004","countryUrl":"https://healthrecordrights.com/brief/belgium/","why":"Records made for employers about workers' sick leave can leak too.","sourceType":"journalism","lang":"fr","providerName":"MediCheck","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BLZ","country":"Belize","date":"2025-05-19","headline":"Patient says private hospital has refused for months to release her records","paraphrase":"A patient said a private hospital refused to release her records despite letters from her lawyer since the previous year. She wanted them to understand her past care. Her lawyer said he would go to court to obtain them.","source":"7 News Belize","url":"https://www.7newsbelize.com/sstory.php?nid=74278","theme":"access_refused","status":"alleged","id":"BLZ-S001","pageUrl":"https://healthrecordrights.com/real-cases/#BLZ-S001","countryUrl":"https://healthrecordrights.com/brief/belize/","why":"Without your own file you cannot check what was done to you or seek redress for a possible error.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"BLZ","country":"Belize","date":"2025-02-05","headline":"Patient told hospital policy bars her from seeing her own medical records","paraphrase":"A friend acting for a patient said a private hospital denied their request for the patient's medical records, citing hospital policy, after something went wrong in the patient's care. No one from the hospital had met them to explain.","source":"7 News Belize","url":"https://7newsbelize.com/sstory.php?nid=73197","theme":"access_refused","status":"alleged","id":"BLZ-S002","pageUrl":"https://healthrecordrights.com/real-cases/#BLZ-S002","countryUrl":"https://healthrecordrights.com/brief/belize/","why":"A blanket policy of refusal leaves patients unable to learn what went wrong in their own care.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"BOL","country":"Bolivia","date":"2025-08-13","headline":"Family says hospital left a patient's record request unanswered; court declines to rule","paraphrase":"Relatives of an adult patient said in a constitutional claim that a written request for his clinical record went unanswered. His lawyer later acknowledged obtaining copies. The Constitutional Court denied protection without examining the merits.","source":"Tribunal Constitucional Plurinacional (SCP 0923/2025-S1)","url":"https://jurisprudenciaconstitucional.com/resolucion/223637-sentencia-constitucional-plurinacional-0923-2025-s1","theme":"access_delay_or_cost","status":"alleged","id":"BOL-S001","pageUrl":"https://healthrecordrights.com/real-cases/#BOL-S001","countryUrl":"https://healthrecordrights.com/brief/bolivia/","why":"A written request for one's own clinical record can sit unanswered until the patient turns to the courts.","sourceType":"court_judgment","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"BIH","country":"Bosnia and Herzegovina","date":"2025-08-11","headline":"Ombudsman tells health centre to answer a request to correct a record","paraphrase":"A patient asked a public health centre to amend her health record and heard nothing for two years. The ombudsman found no formal decision had been made and told the centre to decide at once.","source":"Institucija ombudsmena za ljudska prava Bosne i Hercegovine","url":"https://www.ombudsmen.gov.ba/Novost.aspx?newsid=3633&lang=BS","archiveUrl":"https://web.archive.org/web/20261005160217/https://www.ombudsmen.gov.ba/Novost.aspx?newsid=3633&lang=BS","theme":"record_wrong","status":"finding","id":"BIH-S001","pageUrl":"https://healthrecordrights.com/real-cases/#BIH-S001","countryUrl":"https://healthrecordrights.com/brief/bosnia-and-herzegovina/","why":"A request to change your own health record can sit unanswered for years unless an outside body steps in.","sourceType":"regulator_decision","lang":"bs","providerName":"JZU Dom zdravlja Istočno Sarajevo","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BIH","country":"Bosnia and Herzegovina","date":"2025-03-17","headline":"Patient asking to move a health file is told months later none exists","paraphrase":"A patient asked a public health centre to transfer his file to another clinic. Two months later he was told he had no file there. The ombudsman told the centre to open one and explain his options.","source":"Institucija ombudsmena za ljudska prava Bosne i Hercegovine","url":"https://www.ombudsmen.gov.ba/Novost.aspx?newsid=3412&lang=BS","archiveUrl":"https://web.archive.org/web/20261005160249/https://www.ombudsmen.gov.ba/Novost.aspx?newsid=3412&lang=BS","theme":"lost_between_providers","status":"finding","id":"BIH-S002","pageUrl":"https://healthrecordrights.com/real-cases/#BIH-S002","countryUrl":"https://healthrecordrights.com/brief/bosnia-and-herzegovina/","why":"Moving to a new doctor depends on the old clinic finding and releasing your file.","sourceType":"regulator_decision","lang":"bs","providerName":"JU Dom zdravlja Kantona Sarajevo","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BIH","country":"Bosnia and Herzegovina","date":"2025-11-07","headline":"Private clinic closes without notice, leaving patients unable to move their care","paraphrase":"A private clinic shut without telling patients. Health inspectors reported faults in how it kept patient files, and a patient trying to move to another clinic was refused because no one was left to sign the paperwork.","source":"Radio Slobodna Evropa","url":"https://www.slobodnaevropa.org/a/klinika-sarajevo-zatvaranje-vantjelesna-oplodnja-embriji/33583274.html","archiveUrl":"https://web.archive.org/web/20261005160312/https://www.slobodnaevropa.org/a/klinika-sarajevo-zatvaranje-vantjelesna-oplodnja-embriji/33583274.html","theme":"lost_between_providers","status":"finding","id":"BIH-S003","pageUrl":"https://healthrecordrights.com/real-cases/#BIH-S003","countryUrl":"https://healthrecordrights.com/brief/bosnia-and-herzegovina/","why":"When a provider shuts suddenly, patients can be left with no one to release their records.","sourceType":"journalism","lang":"bs","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BRA","country":"Brazil","date":"2026-07-08","headline":"Regulator opens case after attack on health operator affecting 500,000 patients' records","paraphrase":"A ransomware attack on an organisation running public health units in several states affected records of about 500,000 patients. The data authority opened a sanction case, citing poor notice to those affected. The operator denies any data leaked.","source":"CNN Brasil","url":"https://www.cnnbrasil.com.br/nacional/brasil/anpd-investiga-ataque-cibernetico-que-vazou-dados-de-500-mil-pacientes/","archiveUrl":"https://web.archive.org/web/20261005160750/https://www.cnnbrasil.com.br/nacional/brasil/anpd-investiga-ataque-cibernetico-que-vazou-dados-de-500-mil-pacientes/","theme":"breach","status":"alleged","id":"BRA-S003","pageUrl":"https://healthrecordrights.com/real-cases/#BRA-S003","countryUrl":"https://healthrecordrights.com/brief/brazil/","why":"Patients in public clinics may never be told properly that their records were caught in an attack.","sourceType":"journalism","lang":"pt","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BRA","country":"Brazil","date":"2026-05-28","headline":"Court upholds damages after a patient's test details appeared in internet search","paraphrase":"Data about a woman's medical test could be opened directly from a major search engine, with no password. A Santa Catarina court found two clinics failed to protect it and upheld R$5,000 in damages, ordering the data removed.","source":"Consultor Jurídico (ConJur)","url":"https://conjur.com.br/2026-mai-28/tj-sc-manda-clinica-indenizar-paciente-por-exposicao-de-dados-sensiveis/","archiveUrl":"https://web.archive.org/web/20261005160808/https://conjur.com.br/2026-mai-28/tj-sc-manda-clinica-indenizar-paciente-por-exposicao-de-dados-sensiveis/","theme":"breach","status":"finding","id":"BRA-S004","pageUrl":"https://healthrecordrights.com/real-cases/#BRA-S004","countryUrl":"https://healthrecordrights.com/brief/brazil/","why":"Clinics must keep patients' results off the open web; a court held two clinics jointly liable.","sourceType":"journalism","lang":"pt","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BRA","country":"Brazil","date":"2024-12-16","headline":"Pharmacy chain fined R$8.4 million for demanding customers' tax ID at checkout","paraphrase":"Minas Gerais consumer authority Procon fined a pharmacy chain over stores requiring customers' CPF at the counter. The decision warned hidden profiling of purchases could expose medicine records, for example to insurers refusing cover.","source":"Hoje em Dia","url":"https://www.hojeemdia.com.br/minas/droga-raia-e-multada-em-r-8-4-milh-es-por-exigir-cpf-de-cliente-na-hora-da-compra-em-bh-1.1044784","archiveUrl":"https://web.archive.org/web/20261005160910/https://www.hojeemdia.com.br/minas/droga-raia-e-multada-em-r-8-4-milh-es-por-exigir-cpf-de-cliente-na-hora-da-compra-em-bh-1.1044784","theme":"sold_or_shared","status":"finding","id":"BRA-S005","pageUrl":"https://healthrecordrights.com/real-cases/#BRA-S005","countryUrl":"https://healthrecordrights.com/brief/brazil/","why":"Linking medicine purchases to a person's ID builds a health profile that could later be used against them.","sourceType":"journalism","lang":"pt","providerName":"RaiaDrogasil (Droga Raia)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BRA","country":"Brazil","date":"2024-12-18","headline":"Nurse technician fired for opening someone's medical record 18 times without a care reason","paraphrase":"A hospital nursing technician opened another person's record 18 times, though she was not caring for her, over a personal dispute. A labour court in Rio Grande do Sul upheld her dismissal for cause.","source":"Tribunal Regional do Trabalho da 4ª Região (Rio Grande do Sul)","url":"https://www.trt4.jus.br/portais/trt4/modulos/noticias/50725782","archiveUrl":"https://web.archive.org/web/20261005161036/https://www.trt4.jus.br/portais/trt4/modulos/noticias/50725782","theme":"breach","status":"finding","id":"BRA-S006","pageUrl":"https://healthrecordrights.com/real-cases/#BRA-S006","countryUrl":"https://healthrecordrights.com/brief/brazil/","why":"Staff who can open records may use them in personal disputes; the court backed the dismissal.","sourceType":"court_judgment","lang":"pt","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BRN","country":"Brunei","date":"2026-01-16","headline":"Network fault cut a public health centre off from patient records","paraphrase":"An internet fault left a government health centre unable to reach the national Bru-HIMS record system. Test result reviews, sample collection and medicine pickups stopped there, and patients were sent to other centres. The ministry apologised.","source":"Borneo Bulletin","url":"https://borneobulletin.com.bn/internet-disruption-affects-sungai-liang-health-centre/","theme":"access_delay_or_cost","status":"admitted","id":"BRN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#BRN-S001","countryUrl":"https://healthrecordrights.com/brief/brunei/","why":"When the national record system drops, patients cannot get test results reviewed or medicines collected locally.","sourceType":"journalism","lang":"en","providerName":"Ministry of Health","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"BRN","country":"Brunei","date":"2026-03-26","headline":"Record system outage halted services at a national health screening centre","paraphrase":"A network failure made the Bru-HIMS record system unavailable at a government screening centre. Worker screening, vaccination and occupational health services were affected and people with appointments were told to reschedule. The ministry apologised.","source":"The Star (Borneo Bulletin/ANN)","url":"https://www.thestar.com.my/aseanplus/aseanplus-news/2026/03/26/brunei-health-services-disrupted-due-to-technical-issues","archiveUrl":"https://web.archive.org/web/20261005161211/https://www.thestar.com.my/aseanplus/aseanplus-news/2026/03/26/brunei-health-services-disrupted-due-to-technical-issues","theme":"access_delay_or_cost","status":"admitted","id":"BRN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#BRN-S002","countryUrl":"https://healthrecordrights.com/brief/brunei/","why":"One record system outage can stop screening and clinic services, leaving people to rebook appointments.","sourceType":"journalism","lang":"en","providerName":"Ministry of Health","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BGR","country":"Bulgaria","date":"2024-10-23","headline":"Health fund sanctions providers after patients spot unperformed care in their records","paraphrase":"Insured people using the eZdrave app found medical activities in their electronic records that had never been carried out. After checks, the national health fund imposed fines, partly ended contracts and recovered money paid.","source":"zdrave.net","url":"https://www.zdrave.net/%D0%9D%D0%BE%D0%B2%D0%B8%D0%BD%D0%B8/%D0%A1%D0%B0%D0%BD%D0%BA%D1%86%D0%B8%D0%B8-%D0%B7%D0%B0-%D0%BE%D1%82%D1%87%D0%B5%D1%82%D0%B5%D0%BD%D0%B8-%D0%BD%D0%B5%D0%B8%D0%B7%D0%B2%D1%8A%D1%80%D1%88%D0%B5%D0%BD%D0%B8-%D0%B4%D0%B5%D0%B9%D0%BD%D0%BE%D1%81%D1%82%D0%B8-%D0%BD%D0%B0%D0%BB%D0%BE%D0%B6%D0%B8-%D0%9D%D0%97%D0%9E%D0%9A-%D0%BF%D0%BE-%D1%81%D0%B8%D0%B3%D0%BD%D0%B0%D0%BB%D0%B8-%D0%BD%D0%B0-%D0%BF%D0%BE%D1%82%D1%80%D0%B5%D0%B1%D0%B8%D1%82%D0%B5%D0%BB%D0%B8-%D0%BD%D0%B0-%D0%B5%D0%97%D0%B4%D1%80%D0%B0%D0%B2%D0%B5-(%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%B5%D0%BD%D0%B0)/n31819","theme":"record_wrong","status":"finding","id":"BGR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#BGR-S001","countryUrl":"https://healthrecordrights.com/brief/bulgaria/","why":"Patients reading their own electronic record found care billed in their name that never happened.","sourceType":"journalism","lang":"bg","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"BGR","country":"Bulgaria","date":"2026-09-03","headline":"Patients flag 1,760 record entries they say never happened","paraphrase":"A new eZdrave feature asks patients whether they attended each recorded visit. Within weeks they had sent 1,760 reports of exams, test results and hospital stays they did not recognise, and 560 checks had begun.","source":"Gospodari.com","url":"https://gospodari.com/novini/nov-modul-v-ezdrave-pokazva-dali-na-vashe-ime-sa-otcheteni-fiktivni-medicinski-deynosti","archiveUrl":"https://web.archive.org/web/20261005155850/https://gospodari.com/novini/nov-modul-v-ezdrave-pokazva-dali-na-vashe-ime-sa-otcheteni-fiktivni-medicinski-deynosti","theme":"record_wrong","status":"alleged","id":"BGR-S002","pageUrl":"https://healthrecordrights.com/real-cases/#BGR-S002","countryUrl":"https://healthrecordrights.com/brief/bulgaria/","why":"A new question in the app lets patients challenge entries in their own record, and many already have.","sourceType":"journalism","lang":"bg","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BGR","country":"Bulgaria","date":"2026-09-25","headline":"Complaints about wrong entries in electronic health records rise by two thirds","paraphrase":"Complaints that electronic records list care patients never received rose 68.75 percent in July and August 2026 over a year earlier. The health fund links the rise to wider use of the eZdrave app.","source":"Paragraf.bg","url":"https://paragraf.bg/za-1-g-zhalbite-za-nesaotvetstviya-mezhdu-otrazeni-v-dosieto-i-polzvanite-meditsinski-uslugi-sa-68-75-poveche","archiveUrl":"https://web.archive.org/web/20261005155916/https://paragraf.bg/za-1-g-zhalbite-za-nesaotvetstviya-mezhdu-otrazeni-v-dosieto-i-polzvanite-meditsinski-uslugi-sa-68-75-poveche","theme":"record_wrong","status":"alleged","id":"BGR-S003","pageUrl":"https://healthrecordrights.com/real-cases/#BGR-S003","countryUrl":"https://healthrecordrights.com/brief/bulgaria/","why":"As more people open their records, more find services listed that they never received.","sourceType":"journalism","lang":"bg","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"BGR","country":"Bulgaria","date":"2026-01-25","headline":"Regulator fined a hospital for revealing a patient's health details on television","paraphrase":"A patient said on television that her discharge record was wrong. A hospital director responded on air with her health details. The data protection commission fined the hospital 10,000 leva, rejecting its consent argument.","source":"Dnes Bulgaria","url":"https://dnesbulgaria.com/%D0%BA%D0%B7%D0%BB%D0%B4-%D0%B3%D0%BB%D0%BE%D0%B1%D0%B8-%D0%B1%D0%BE%D0%BB%D0%BD%D0%B8%D1%86%D0%B0-%D1%81%D1%8A%D1%80%D1%86%D0%B5-%D0%B8-%D0%BC%D0%BE%D0%B7%D1%8A%D0%BA-%D0%B2-%D0%B1%D1%83%D1%80/","archiveUrl":"https://web.archive.org/web/20261005155936/https://dnesbulgaria.com/%D0%BA%D0%B7%D0%BB%D0%B4-%D0%B3%D0%BB%D0%BE%D0%B1%D0%B8-%D0%B1%D0%BE%D0%BB%D0%BD%D0%B8%D1%86%D0%B0-%D1%81%D1%8A%D1%80%D1%86%D0%B5-%D0%B8-%D0%BC%D0%BE%D0%B7%D1%8A%D0%BA-%D0%B2-%D0%B1%D1%83%D1%80/","theme":"sold_or_shared","status":"finding","id":"BGR-S004","pageUrl":"https://healthrecordrights.com/real-cases/#BGR-S004","countryUrl":"https://healthrecordrights.com/brief/bulgaria/","why":"Complaining about your record should not cost you your privacy; showing one document is not consent to publish all of it.","sourceType":"journalism","lang":"bg","providerName":"Болница „Сърце и мозък“","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CMR","country":"Cameroon","date":"2026-07-05","headline":"Fire at a public hospital destroyed its medical records unit","paraphrase":"A June 2026 fire at a public hospital in the North-West Region destroyed its medical records unit, along with its drug store and computer equipment, while the health ministry planned reconstruction.","source":"Cameroon News Agency","url":"https://cameroonnewsagency.com/government-begins-reconstruction-process-for-fire-damaged-bamenda-regional-hospital/","theme":"other","status":"alleged","id":"CMR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#CMR-S001","countryUrl":"https://healthrecordrights.com/brief/cameroon/","why":"If a record exists only in one archive, a fire can erase a patient's history.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CAN","country":"Canada","date":"2026-03-19","headline":"Doctor did not answer a patient's request for their own health record","paraphrase":"A patient in Ontario asked their doctor for access to their health information and got no reply within the legal time limit. The commissioner treated the silence as a refusal and ordered the doctor to respond.","source":"Information and Privacy Commissioner of Ontario (PHIPA Decision 332)","url":"https://www.ipc.on.ca/en/decisions/latest-decisions/phipa-decision-332","archiveUrl":"https://web.archive.org/web/20261005161347/https://www.ipc.on.ca/en/decisions/latest-decisions/phipa-decision-332","theme":"access_refused","status":"finding","id":"CAN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#CAN-S001","countryUrl":"https://healthrecordrights.com/brief/canada/","why":"Silence counts as a refusal under Ontario law, and the regulator can order a doctor to respond.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CAN","country":"Canada","date":"2026-02-06","headline":"Health authority ordered to release withheld lines from a patient's own hospital record","paraphrase":"A patient in British Columbia asked for her own hospital records. The health authority released them but blacked out three sentences. The commissioner found no good reason to withhold them and ordered them disclosed.","source":"Office of the Information and Privacy Commissioner for British Columbia (Order F26-09)","url":"https://www.oipc.bc.ca/documents/orders/3088","archiveUrl":"https://web.archive.org/web/20261005161357/https://www.oipc.bc.ca/documents/orders/3088","theme":"access_refused","status":"finding","id":"CAN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#CAN-S002","countryUrl":"https://healthrecordrights.com/brief/canada/","why":"Patients can challenge redactions in their own records, and the regulator may order the hidden parts released.","sourceType":"regulator_decision","lang":"en","providerName":"Interior Health Authority","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CAN","country":"Canada","date":"2025-03-31","headline":"Health worker looked into 70 people's records; patients not properly told","paraphrase":"An employee opened the electronic health records of 70 people in Saskatchewan 210 times without a work reason. The commissioner found the health authority did not contain the breach properly or tell those affected enough.","source":"Office of the Saskatchewan Information and Privacy Commissioner (Investigation Report 266-2024, 031-2025)","url":"https://oipc.sk.ca/assets/hipa-investigation_266-2024-031-2025.pdf","archiveUrl":"https://web.archive.org/web/20261005192459/https://oipc.sk.ca/assets/hipa-investigation_266-2024-031-2025.pdf","theme":"breach","status":"finding","id":"CAN-S003","pageUrl":"https://healthrecordrights.com/real-cases/#CAN-S003","countryUrl":"https://healthrecordrights.com/brief/canada/","why":"Patients often learn late, and with little detail, that staff opened their records without reason.","sourceType":"regulator_decision","lang":"en","providerName":"Saskatchewan Health Authority","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CAN","country":"Canada","date":"2026-04-29","headline":"Hospital network kept failing to stop staff opening patients' records, watchdog finds","paraphrase":"Ontario's privacy commissioner found several workers at an Ontario hospital network opened patient records without authority between 2023 and 2025. In one breach up to 326 patients were affected, and some were not told for ten months.","source":"CBC News","url":"https://www.cbc.ca/news/canada/toronto/lakeridge-health-failed-to-protect-patients-medical-records-9.7182011","archiveUrl":"https://web.archive.org/web/20261005161440/https://www.cbc.ca/news/canada/toronto/lakeridge-health-failed-to-protect-patients-medical-records-9.7182011","theme":"breach","status":"finding","id":"CAN-S004","pageUrl":"https://healthrecordrights.com/real-cases/#CAN-S004","countryUrl":"https://healthrecordrights.com/brief/canada/","why":"Patients may not learn for months that staff looked at their records, while access stays open.","sourceType":"journalism","lang":"en","providerName":"Lakeridge Health","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CPV","country":"Cape Verde","date":"2025-07-14","headline":"Health regulator warns providers after complaint over patient data sent abroad","paraphrase":"Following a complaint, the regulator learned that several health facilities sent patient samples abroad for lab work, sharing sensitive personal data. It issued an alert reminding providers that patient consent is required.","source":"ERIS (Entidade Reguladora Independente da Saúde)","url":"https://eris.cv/index.php/noticias/916-setor-da-saude-eris-emite-alerta-sobre-consentimento-informado-dos-utentes-previo-a-prestacao-de-cuidados-de-saude-incluindo-cuidados-transfronteiricos","theme":"sold_or_shared","status":"finding","id":"CPV-S001","pageUrl":"https://healthrecordrights.com/real-cases/#CPV-S001","countryUrl":"https://healthrecordrights.com/brief/cape-verde/","why":"Samples sent to foreign labs carry sensitive patient data; the law requires the patient's consent and notice to the data authority.","sourceType":"regulator_decision","lang":"pt","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CAF","country":"Central African Republic","date":"2025-01-27","headline":"Patients wait weeks for test and imaging results at a public hospital","paraphrase":"A news report says lab results and scans at a public hospital pile up unread. Patients told reporters they waited ten days to two weeks without receiving the report on their own tests.","source":"Corbeau News Centrafrique","url":"https://corbeaunews-centrafrique.org/a-lhopital-communautaire-de-bangui-un-systeme-de-soins-en-plein-chaos/","archiveUrl":"https://web.archive.org/web/20261005161237/https://corbeaunews-centrafrique.org/a-lhopital-communautaire-de-bangui-un-systeme-de-soins-en-plein-chaos/","theme":"access_delay_or_cost","status":"alleged","id":"CAF-S001","pageUrl":"https://healthrecordrights.com/real-cases/#CAF-S001","countryUrl":"https://healthrecordrights.com/brief/central-african-republic/","why":"Results that sit unread for weeks keep patients from knowing and using what their own records say.","sourceType":"journalism","lang":"fr","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CHL","country":"Chile","date":"2026-04-23","headline":"Court orders clinic to give a deceased patient's record to his children","paraphrase":"A clinic refused to give a deceased patient's record to some of his children, saying all heirs had to ask together. The appeals court called the refusal illegal and arbitrary and ordered a full copy delivered within three working days.","source":"Poder Judicial de Chile, Corte de Apelaciones de Santiago (rol 24.909-2025)","url":"https://www.pjud.cl/prensa-y-comunicaciones/noticias-del-poder-judicial/144388","theme":"access_refused","status":"finding","id":"CHL-S001","pageUrl":"https://healthrecordrights.com/real-cases/#CHL-S001","countryUrl":"https://healthrecordrights.com/brief/chile/","why":"Heirs have a legal right to a relative's record; a clinic cannot add conditions the law does not set.","sourceType":"court_judgment","lang":"es","providerName":"Fundación Arturo López Pérez (FALP)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CHL","country":"Chile","date":"2026-05-07","headline":"Lookup website showed patients' diagnoses to anyone who typed in their ID number","paraphrase":"For about 48 hours, a people-search website let anyone enter a Chilean ID number and see that person's diagnoses under the national guaranteed-care scheme, alongside address and contact details. Police and the cybersecurity agency are investigating.","source":"BioBioChile (BBCL Investiga)","url":"https://www.biobiochile.cl/especial/bbcl-investiga/noticias/articulos/2026/05/07/desentranando-rutify-la-plataforma-hacker-que-expuso-datos-medicos-y-hoy-es-investigada-por-la-pdi.shtml","archiveUrl":"https://web.archive.org/web/20261005161736/https://www.biobiochile.cl/especial/bbcl-investiga/noticias/articulos/2026/05/07/desentranando-rutify-la-plataforma-hacker-que-expuso-datos-medicos-y-hoy-es-investigada-por-la-pdi.shtml","theme":"breach","status":"alleged","id":"CHL-S002","pageUrl":"https://healthrecordrights.com/real-cases/#CHL-S002","countryUrl":"https://healthrecordrights.com/brief/chile/","why":"Records taken from health systems can be republished where anyone with a national ID number can read them.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CHL","country":"Chile","date":"2025-12-24","headline":"Consumer agency demands answers after 250 GB of patient records stolen from private clinic","paraphrase":"A ransomware group reportedly took about 250 GB from a private clinic, including clinical records, test results and identity card copies. Chile's consumer agency ordered the clinic to report how many patients were affected and how they were told.","source":"BioBioChile","url":"https://www.biobiochile.cl/noticias/economia/negocios-y-empresas/2025/12/24/fichas-clinicas-y-hasta-resultados-de-vih-sernac-oficia-a-clinica-davila-tras-robo-con-ciberataque.shtml","archiveUrl":"https://web.archive.org/web/20261005161805/https://www.biobiochile.cl/noticias/economia/negocios-y-empresas/2025/12/24/fichas-clinicas-y-hasta-resultados-de-vih-sernac-oficia-a-clinica-davila-tras-robo-con-ciberataque.shtml","theme":"breach","status":"alleged","id":"CHL-S003","pageUrl":"https://healthrecordrights.com/real-cases/#CHL-S003","countryUrl":"https://healthrecordrights.com/brief/chile/","why":"Patients need to know quickly when their records and identity documents are stolen; regulators had to ask.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CHL","country":"Chile","date":"2025-08-19","headline":"Cyberattack on national public health lab doubled waits for patients' confirmatory test results","paraphrase":"After a cyberattack slowed the national public health institute's systems, confirmatory results for patients in at least seven hospitals took about 30 days instead of 12 to 15. The institute blamed a switch to a manual system.","source":"CIPER Chile","url":"https://www.ciperchile.cl/2025/08/19/hospitales-fueron-afectados-por-retrasos-en-entrega-de-resultados-vih-y-hepatitis-tras-el-ciberataque-al-instituto-de-salud-publica/","archiveUrl":"https://web.archive.org/web/20261005161849/https://www.ciperchile.cl/2025/08/19/hospitales-fueron-afectados-por-retrasos-en-entrega-de-resultados-vih-y-hepatitis-tras-el-ciberataque-al-instituto-de-salud-publica/","theme":"access_delay_or_cost","status":"admitted","id":"CHL-S004","pageUrl":"https://healthrecordrights.com/real-cases/#CHL-S004","countryUrl":"https://healthrecordrights.com/brief/chile/","why":"When a central lab's systems go down, patients across many hospitals wait longer for results that decide their care.","sourceType":"journalism","lang":"es","providerName":"Instituto de Salud Pública (ISP)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CHN","country":"China","date":"2026-05-08","headline":"Hospital booking contractor secretly copied millions of patients' details, court rules","paraphrase":"A software firm that ran a hospital's online appointment system copied registration details of about 2.88 million patients into its own database over several years. A court convicted the firm and its managers, with fines and prison terms.","source":"Supreme People's Court of China (typical cases)","url":"https://www.court.gov.cn/zixun/xiangqing/499271.html","archiveUrl":"https://web.archive.org/web/20261005161936/https://www.court.gov.cn/zixun/xiangqing/499271.html","theme":"breach","status":"finding","id":"CHN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#CHN-S001","countryUrl":"https://healthrecordrights.com/brief/china/","why":"Outside firms that run hospital systems can quietly take patient data; patients would not know unless prosecutors act.","sourceType":"court_judgment","lang":"zh","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CHN","country":"China","date":"2025-04-28","headline":"Shanghai regulator penalises online medical firms after patient data was stolen and left unencrypted","paraphrase":"Shanghai's cyberspace regulator penalised several online medical service firms. One had unpatched flaws and suspicious foreign access that led to data theft; another stored over 6.5 million patient records, including conditions and prescriptions, without encryption.","source":"The Paper (澎湃新闻)","url":"https://www.thepaper.cn/newsDetail_forward_30736580","archiveUrl":"https://web.archive.org/web/20261005162140/https://www.thepaper.cn/newsDetail_forward_30736580","theme":"breach","status":"finding","id":"CHN-S004","pageUrl":"https://healthrecordrights.com/real-cases/#CHN-S004","countryUrl":"https://healthrecordrights.com/brief/china/","why":"Online health services hold names, ID numbers and conditions; weak security let outsiders take patient data.","sourceType":"journalism","lang":"zh","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CHN","country":"China","date":"2026-06-03","headline":"National notice lists health apps that shared users' data with third parties without consent","paraphrase":"A national cybersecurity notice listed 71 apps breaking personal data rules, including several medical and health apps. Violations included giving personal data to third parties without separate consent, no way to withdraw consent, and missing encryption.","source":"21st Century Business Herald (21经济网)","url":"https://www.21jingji.com/article/20260603/herald/fba2d42a4d84eabb6a46c30e8f5d3855.html","archiveUrl":"https://web.archive.org/web/20261005162237/https://www.21jingji.com/article/20260603/herald/fba2d42a4d84eabb6a46c30e8f5d3855.html","theme":"sold_or_shared","status":"finding","id":"CHN-S005","pageUrl":"https://healthrecordrights.com/real-cases/#CHN-S005","countryUrl":"https://healthrecordrights.com/brief/china/","why":"Health apps and hospital mini-programs hold sensitive data; some passed it on without telling users or getting consent.","sourceType":"journalism","lang":"zh","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CHN","country":"China","date":"2025-10-28","headline":"Hospital apps let anyone with a patient's name and ID number download her records","paraphrase":"Several large hospitals' online services released test reports and records to anyone with a patient's name and ID number. Someone a woman knew used this for two years to obtain and circulate her records. Some hospitals then added identity checks.","source":"China Women's News (via Tencent News)","url":"https://news.qq.com/rain/a/20251028A03EDO00","archiveUrl":"https://web.archive.org/web/20261005162316/https://news.qq.com/rain/a/20251028A03EDO00","theme":"breach","status":"admitted","id":"CHN-S006","pageUrl":"https://healthrecordrights.com/real-cases/#CHN-S006","countryUrl":"https://healthrecordrights.com/brief/china/","why":"If a name and ID number unlock a record, anyone who knows them can read and spread it without the patient knowing.","sourceType":"journalism","lang":"zh","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CHN","country":"China","date":"2025-05-06","headline":"Investigation finds hospital staff selling patients' contact details for about 50 yuan each","paraphrase":"Reporters found some hospital staff and outside contractors selling patients' names, addresses and phone numbers to private companies, about 50 yuan per record. A patient described being contacted by a company that already knew her private details.","source":"Legal Daily (via Hunan Daily / voc.com.cn)","url":"https://m.voc.com.cn/xhn/news/202505/29345447.html","archiveUrl":"https://web.archive.org/web/20261005162352/https://m.voc.com.cn/xhn/news/202505/29345447.html","theme":"sold_or_shared","status":"alleged","id":"CHN-S007","pageUrl":"https://healthrecordrights.com/real-cases/#CHN-S007","countryUrl":"https://healthrecordrights.com/brief/china/","why":"Details patients give a hospital can end up with sales companies, who then contact patients directly.","sourceType":"journalism","lang":"zh","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"COL","country":"Colombia","date":"2026-04-13","headline":"Regulator orders hospital and insurer to fix data handling after a patient's record leaked","paraphrase":"Sensitive details from a woman's health record reached third parties without her consent. The data protection regulator found the hospital and her health insurer at fault and ordered five corrective measures, including staff training and stronger confidentiality.","source":"La FM","url":"https://www.lafm.com.co/economia/sin-sanciona-a-eps-por-revelar-datos-personales-de-paciente-que-interrumpe-su-embarazo-396092","theme":"sold_or_shared","status":"finding","id":"COL-S001","pageUrl":"https://healthrecordrights.com/real-cases/#COL-S001","countryUrl":"https://healthrecordrights.com/brief/colombia/","why":"Shows the data regulator will order health bodies to change how they guard sensitive record entries.","sourceType":"journalism","lang":"es","providerName":"E.S.E. Hospital Departamental San Antonio de Padua; Asociación Indígena del Cauca (AIC EPSI)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"COL","country":"Colombia","date":"2025-08-23","headline":"Insurer sanctioned for sending a patient's full record to the patient's employer","paraphrase":"During a workplace illness review, a health insurer sent a patient's complete record, including sensitive test results, to four managers at the patient's employer. The data protection regulator sanctioned the insurer, saying the disclosure had no necessity or relevance.","source":"El Tiempo","url":"https://www.eltiempo.com/salud/sic-sanciona-a-sos-eps-por-divulgar-sin-autorizacion-la-historia-clinica-de-paciente-con-vih-3484039","archiveUrl":"https://web.archive.org/web/20261005162702/https://www.eltiempo.com/salud/sic-sanciona-a-sos-eps-por-divulgar-sin-autorizacion-la-historia-clinica-de-paciente-con-vih-3484039","theme":"sold_or_shared","status":"finding","id":"COL-S002","pageUrl":"https://healthrecordrights.com/real-cases/#COL-S002","countryUrl":"https://healthrecordrights.com/brief/colombia/","why":"A health record shared with an employer can cost someone their job; the regulator called it a grave violation.","sourceType":"journalism","lang":"es","providerName":"SOS EPS","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"COL","country":"Colombia","date":"2024-10-17","headline":"Court orders clinic to apologise after staff passed patient data to an outside group","paraphrase":"Clinic staff shared a woman's personal and medical details with an outside organisation, which then called and messaged her. The Constitutional Court ruled her privacy was violated and ordered the clinic to apologise publicly and investigate its staff.","source":"El Colombiano","url":"https://www.elcolombiano.com/colombia/salud/aborto-clinica-que-filtro-datos-de-mujer-que-pidio-ive-a-fundacion-tendra-que-investigar-a-su-personal-FC25637332","theme":"sold_or_shared","status":"finding","id":"COL-S003","pageUrl":"https://healthrecordrights.com/real-cases/#COL-S003","countryUrl":"https://healthrecordrights.com/brief/colombia/","why":"Record confidentiality is a court-protected right; staff who leak patient data expose the clinic to orders.","sourceType":"journalism","lang":"es","providerName":"Clínica Los Cobos","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"COL","country":"Colombia","date":"2026-04-02","headline":"Cyberattack on the national health regulator exposed patient records and complaints","paraphrase":"The national health regulator confirmed unauthorised access to its document system. Reports say files downloaded included medical histories and patients' petitions and complaints, about 1.6 percent of its document store.","source":"Pulzo","url":"https://www.pulzo.com/nacion/crece-alerta-por-ataque-supersalud-por-que-filtraron-datos-pacientes-PP5122633","archiveUrl":"https://web.archive.org/web/20261005162805/https://www.pulzo.com/nacion/crece-alerta-por-ataque-supersalud-por-que-filtraron-datos-pacientes-PP5122633","theme":"breach","status":"admitted","id":"COL-S004","pageUrl":"https://healthrecordrights.com/real-cases/#COL-S004","countryUrl":"https://healthrecordrights.com/brief/colombia/","why":"Records patients send a regulator with their complaints can themselves leak, beyond any provider's control.","sourceType":"journalism","lang":"es","providerName":"Superintendencia Nacional de Salud (Supersalud)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CRI","country":"Costa Rica","date":"2026-05-28","headline":"Constitutional court says TV channels breached privacy by airing a person's prescriptions","paraphrase":"Two television channels broadcast images of a person's medical prescriptions taken from a confidential case file. The constitutional court ruled this violated his privacy, ordered every image removed and made the channels liable for damages.","source":"La Nación","url":"https://www.nacion.com/sucesos/sala-iv-condeno-a-opa-y-trivision-por-difundir/6IR4BIEW4VF4VLQEKAEU4RNGTQ/story/","archiveUrl":"https://web.archive.org/web/20261005163032/https://www.nacion.com/sucesos/sala-iv-condeno-a-opa-y-trivision-por-difundir/6IR4BIEW4VF4VLQEKAEU4RNGTQ/story/","theme":"sold_or_shared","status":"finding","id":"CRI-S001","pageUrl":"https://healthrecordrights.com/real-cases/#CRI-S001","countryUrl":"https://healthrecordrights.com/brief/costa-rica/","why":"The court held that prescription details are health data and may not be broadcast.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CRI","country":"Costa Rica","date":"2024-11-28","headline":"Public insurer admits staff typing error put a stranger's appointment in a patient's record","paraphrase":"A patient found a specialist appointment he never requested in his digital health record. The public insurer said a clerk mistyped an ID number, cancelled the appointment and said it has no statistics on similar errors.","source":"La Nación","url":"https://www.nacion.com/el-pais/ccss-atribuye-a-error-humano-aislado-cita-en-edus/QE2CEM3GKBFATCIBXONZC7GQV4/story/","archiveUrl":"https://web.archive.org/web/20261005163033/https://www.nacion.com/el-pais/ccss-atribuye-a-error-humano-aislado-cita-en-edus/QE2CEM3GKBFATCIBXONZC7GQV4/story/","theme":"record_wrong","status":"admitted","id":"CRI-S002","pageUrl":"https://healthrecordrights.com/real-cases/#CRI-S002","countryUrl":"https://healthrecordrights.com/brief/costa-rica/","why":"A patient only caught the wrong entry by checking the app; the insurer says it keeps no count of similar errors.","sourceType":"journalism","lang":"es","providerName":"Caja Costarricense de Seguro Social (CCSS)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CRI","country":"Costa Rica","date":"2025-03-20","headline":"National digital record system outage left patients unable to see records or appointments","paraphrase":"A data centre failure took the public insurer's digital health record and app offline for hours. Users could not view their records or appointments, and the insurer told clinics to contact affected patients and rebook them.","source":"La Nación","url":"https://www.nacion.com/el-pais/ccss-restablece-servicios-de-edus-tras-falla/5BLRWA5MIFCA5GB5ARJHMJX2YU/story/","archiveUrl":"https://web.archive.org/web/20261005163131/https://www.nacion.com/el-pais/ccss-restablece-servicios-de-edus-tras-falla/5BLRWA5MIFCA5GB5ARJHMJX2YU/story/","theme":"access_delay_or_cost","status":"admitted","id":"CRI-S003","pageUrl":"https://healthrecordrights.com/real-cases/#CRI-S003","countryUrl":"https://healthrecordrights.com/brief/costa-rica/","why":"When the single national record goes down, patients lose access to their own records and appointments are lost.","sourceType":"journalism","lang":"es","providerName":"Caja Costarricense de Seguro Social (CCSS)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CRI","country":"Costa Rica","date":"2025-09-19","headline":"Patient says digital record lists medicines he never received, complaint still unanswered","paraphrase":"A patient found entries in his digital health record showing medicines given in a hospital department he says he never visited. He complained to the hospital, says no clear answer came, and went public. Officials say it is being investigated.","source":"El Observador","url":"https://observador.cr/paciente-del-hospital-mexico-denuncia-registro-falso-de-fentanilo-en-su-expediente/","archiveUrl":"https://web.archive.org/web/20261005163236/https://observador.cr/paciente-del-hospital-mexico-denuncia-registro-falso-de-fentanilo-en-su-expediente/","theme":"record_wrong","status":"alleged","id":"CRI-S004","pageUrl":"https://healthrecordrights.com/real-cases/#CRI-S004","countryUrl":"https://healthrecordrights.com/brief/costa-rica/","why":"A false entry in a record can follow a patient for years; this one went months without a clear answer.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CRI","country":"Costa Rica","date":"2025-06-15","headline":"Patient says years of paper history never reached the national digital record","paraphrase":"A patient said her earlier care history stayed on paper and was never moved into the national digital record. She also said she cannot easily give a private doctor access to her own record.","source":"La Nación","url":"https://www.nacion.com/el-pais/sirve-el-edus-si-se-cae-a-cada-rato-medicos-y/L4NIDJ6EZVBCDLGOVSRVF2BJSM/story/","archiveUrl":"https://web.archive.org/web/20261005163317/https://www.nacion.com/el-pais/sirve-el-edus-si-se-cae-a-cada-rato-medicos-y/L4NIDJ6EZVBCDLGOVSRVF2BJSM/story/","theme":"lost_between_providers","status":"self_reported","id":"CRI-S005","pageUrl":"https://healthrecordrights.com/real-cases/#CRI-S005","countryUrl":"https://healthrecordrights.com/brief/costa-rica/","why":"Records kept on paper before the digital system can be missing when doctors look, leaving gaps in a patient's history.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"HRV","country":"Croatia","date":"2026-04","headline":"Patients asked a private hospital for their scans; the images had been lost","paraphrase":"Several patients complained that a private hospital never sent copies of their records. The regulator found imaging files had been irretrievably lost, no backups existed, the loss was never reported, and fined the hospital 190,000 euros.","source":"Agencija za zaštitu osobnih podataka (AZOP), final decision UP/I-034-01/24-01/23","url":"https://azop.hr/wp-content/uploads/2026/04/AZOP_Rjesenje-pravomocno_Medico.pdf","archiveUrl":"https://web.archive.org/web/20261005194426/https://azop.hr/wp-content/uploads/2026/04/AZOP_Rjesenje-pravomocno_Medico.pdf","theme":"access_refused","status":"finding","id":"HRV-S001","pageUrl":"https://healthrecordrights.com/real-cases/#HRV-S001","countryUrl":"https://healthrecordrights.com/brief/croatia/","why":"A hospital that keeps no backups can lose records for good, and patients learn only when they ask for a copy.","sourceType":"regulator_decision","lang":"hr","providerName":"Specijalna bolnica Medico","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"HRV","country":"Croatia","date":"2025-07","headline":"Hospital worker photographed a patient's test result on screen and it reached the media","paraphrase":"An unknown hospital employee photographed a patient's result in the hospital system and it was published by the media. The hospital neither reported the breach nor told the patient until their lawyer wrote. The regulator fined it.","source":"Agencija za zaštitu osobnih podataka (AZOP), anonymised decision 567-UP/I-034-01/24-01/31","url":"https://azop.hr/wp-content/uploads/2025/07/bolnica2-clanak-32-33-13-34.pdf","archiveUrl":"https://web.archive.org/web/20261005171944/https://azop.hr/wp-content/uploads/2025/07/bolnica2-clanak-32-33-13-34.pdf","theme":"breach","status":"finding","id":"HRV-S002","pageUrl":"https://healthrecordrights.com/real-cases/#HRV-S002","countryUrl":"https://healthrecordrights.com/brief/croatia/","why":"An insider with screen access can leak a record, and the hospital may not tell the patient or the regulator.","sourceType":"regulator_decision","lang":"hr","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"HRV","country":"Croatia","date":"2025-07","headline":"Ransomware attacker spent a week inside a hospital network and copied data out","paraphrase":"After a ransomware attack, the regulator found a hospital's weak technical safeguards let an attacker roam its systems unnoticed for about seven days and copy at least 3 GB out. The hospital was fined 20,000 euros.","source":"Agencija za zaštitu osobnih podataka (AZOP), anonymised decision 567-UP/I-034-01/24-01/34","url":"https://azop.hr/wp-content/uploads/2025/07/bolnica1-clanak-32.pdf","archiveUrl":"https://web.archive.org/web/20261005171953/https://azop.hr/wp-content/uploads/2025/07/bolnica1-clanak-32.pdf","theme":"breach","status":"finding","id":"HRV-S003","pageUrl":"https://healthrecordrights.com/real-cases/#HRV-S003","countryUrl":"https://healthrecordrights.com/brief/croatia/","why":"Weak security at one hospital exposes every patient whose files sit in its systems.","sourceType":"regulator_decision","lang":"hr","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"HRV","country":"Croatia","date":"2026-08-23","headline":"Hackers claim to have posted thousands of patient records from a Croatian practice","paraphrase":"A hacking group claimed it broke into a private medical practice and posted about 9,400 records for free download, including names, national ID numbers, addresses, medicines, doctors' notes and scanned medical documents. The practice was not named.","source":"Dnevnik.hr (Nova TV)","url":"https://dnevnik.hr/vijesti/hrvatska/udar-na-privatnost-pod-zastitom-gdpr-a-hakeri-besplatno-dijele-medicinsku-dokumentaciju-hrvatskih-gradjana---997427.html","theme":"breach","status":"alleged","id":"HRV-S004","pageUrl":"https://healthrecordrights.com/real-cases/#HRV-S004","countryUrl":"https://healthrecordrights.com/brief/croatia/","why":"Stolen records with ID numbers and clinical notes cannot be taken back once posted for free download.","sourceType":"journalism","lang":"hr","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CUB","country":"Cuba","date":"2025-08-16","headline":"Mother says prison clinic refused her request for her detained daughter's medical record","paraphrase":"The outlet reports that the mother of an adult woman in prison asked the clinic director for her daughter's medical file and was refused. She fears the record lists consultations and treatments that never happened.","source":"Martí Noticias","url":"https://www.martinoticias.com/a/seguridad-del-estado-filma-en-la-c%C3%A1rcel-a-presa-pol%C3%ADtica-en-necesidad-de-atenci%C3%B3n-m%C3%A9dica/422980.html","archiveUrl":"https://web.archive.org/web/20261005163353/https://www.martinoticias.com/a/seguridad-del-estado-filma-en-la-c%C3%A1rcel-a-presa-pol%C3%ADtica-en-necesidad-de-atenci%C3%B3n-m%C3%A9dica/422980.html","theme":"access_refused","status":"alleged","id":"CUB-S001","pageUrl":"https://healthrecordrights.com/real-cases/#CUB-S001","countryUrl":"https://healthrecordrights.com/brief/cuba/","why":"People held in custody depend on others to see their records; a refusal leaves no way to check what care was given.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CUB","country":"Cuba","date":"2026-01-29","headline":"Prisoner says he has no access to his medical record or prescriptions","paraphrase":"An adult prisoner told the outlet that after a hospital stay he was given no medicines in prison and could not learn what the specialist had prescribed, because he had never been given access to his medical record.","source":"CubaNet","url":"https://www.cubanet.org/preso-politico-walfrido-rodriguez-piloto-trasladado-a-la-prision-habanera-el-pitirre/","theme":"access_refused","status":"alleged","id":"CUB-S003","pageUrl":"https://healthrecordrights.com/real-cases/#CUB-S003","countryUrl":"https://healthrecordrights.com/brief/cuba/","why":"Without seeing their own record, people in custody cannot know what was diagnosed or prescribed for them.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CUB","country":"Cuba","date":"2025-02-07","headline":"Patient says specialist wrote nothing in his record after a consultation","paraphrase":"The outlet reports a patient's account that a specialist made no entry at all in his medical record after a consultation.","source":"ADN Cuba","url":"https://adncuba.com/derechos-humanos/periodista-independiente-denuncia-deterioro-de-su-salud-por-falta-de-atencion/","theme":"record_wrong","status":"alleged","id":"CUB-S004","pageUrl":"https://healthrecordrights.com/real-cases/#CUB-S004","countryUrl":"https://healthrecordrights.com/brief/cuba/","why":"A record left blank after a visit hides what was found and makes later care and complaints harder.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CUB","country":"Cuba","date":"2026-06-08","headline":"Families pursuing medical harm claims say full records are hard to obtain","paraphrase":"A reported feature on complaints about medical errors finds that patients and families struggle to get the complete record, which stays with the institution, and that access can be limited or delayed.","source":"Árbol Invertido","url":"https://arbolinvertido.com/sociedad/reportaje-el-laberinto-de-reclamar-los-fallos-medicos-en-cuba","theme":"access_delay_or_cost","status":"alleged","id":"CUB-S005","pageUrl":"https://healthrecordrights.com/real-cases/#CUB-S005","countryUrl":"https://healthrecordrights.com/brief/cuba/","why":"The record is the main evidence in a harm claim; delayed or partial access weakens a patient's case.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CYP","country":"Cyprus","date":"2026-06-29","headline":"Ombudsman's intervention recovers a patient's missing hospital file","paraphrase":"A patient asked the ombudsman for help after a former state hospital could not locate his medical file. After the ombudsman stepped in, the file was found and he regained access to his key health data.","source":"Επίτροπος Διοικήσεως και Προστασίας Ανθρωπίνων Δικαιωμάτων (Ετήσια Έκθεση 2024)","url":"https://www.ombudsman.gov.cy/ombudsman/ombudsman.nsf/All/687657359C6D02BFC2258E25001A09FD/%24file/%CE%95%CF%84%CE%AE%CF%83%CE%B9%CE%B1%20%CE%88%CE%BA%CE%B8%CE%B5%CF%83%CE%B7%202024%20_new1.pdf?OpenElement","theme":"access_delay_or_cost","status":"finding","id":"CYP-S001","pageUrl":"https://healthrecordrights.com/real-cases/#CYP-S001","countryUrl":"https://healthrecordrights.com/brief/cyprus/","why":"Without the file a patient may not be able to continue treatment or claim compensation.","sourceType":"regulator_decision","lang":"el","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CYP","country":"Cyprus","date":"2025-09-26","headline":"State hospitals fined after ten patients' medical files went missing","paraphrase":"The state hospital body reported losing ten patients' medical files and three emergency registration forms. The regulator found no safeguards against loss, fined it 46,500 euros in total and ordered it to tell seven patients.","source":"Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Ετήσια Έκθεση 2024)","url":"https://www.gov.cy/media/sites/67/2026/02/Annual-Report-2024.pdf","theme":"breach","status":"finding","id":"CYP-S002","pageUrl":"https://healthrecordrights.com/real-cases/#CYP-S002","countryUrl":"https://healthrecordrights.com/brief/cyprus/","why":"A lost paper file can leave a patient without their full history or a medical report they asked for.","sourceType":"regulator_decision","lang":"el","providerName":"Οργανισμός Κρατικών Υπηρεσιών Υγείας (ΟΚΥπΥ)","lastVerified":"2026-10-07","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CYP","country":"Cyprus","date":"2025-09-26","headline":"Two doctors reprimanded for giving a patient's medical certificates to his former wife","paraphrase":"A man complained that two doctors issued certificates about his past care to his former wife without his knowledge or consent. The regulator found they processed his health data with no legal basis and reprimanded both.","source":"Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Ετήσια Έκθεση 2024)","url":"https://www.gov.cy/media/sites/67/2026/02/Annual-Report-2024.pdf","theme":"sold_or_shared","status":"finding","id":"CYP-S003","pageUrl":"https://healthrecordrights.com/real-cases/#CYP-S003","countryUrl":"https://healthrecordrights.com/brief/cyprus/","why":"Doctors may not hand a patient's health details to a relative, even a former spouse, without a legal basis.","sourceType":"regulator_decision","lang":"el","lastVerified":"2026-10-07","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CYP","country":"Cyprus","date":"2025-09-26","headline":"Doctor reprimanded after the secretary phoned a patient's next of kin about an appointment","paraphrase":"A doctor's secretary looked up a patient's GeSY account and phoned his father, listed as next of kin, to confirm a booking. The regulator ruled that number was not an alternative contact and reprimanded the doctor.","source":"Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Ετήσια Έκθεση 2024)","url":"https://www.gov.cy/media/sites/67/2026/02/Annual-Report-2024.pdf","theme":"sold_or_shared","status":"finding","id":"CYP-S004","pageUrl":"https://healthrecordrights.com/real-cases/#CYP-S004","countryUrl":"https://healthrecordrights.com/brief/cyprus/","why":"Details stored in a GeSY account are for set purposes; using them to reach relatives can reveal a patient's care.","sourceType":"regulator_decision","lang":"el","lastVerified":"2026-10-07","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CYP","country":"Cyprus","date":"2025-12-11","headline":"Specialist hospital confirms hackers stole patient and staff data and threatened publication","paraphrase":"The hospital said attackers took personal data of patients and staff from its systems and threatened to publish it in the media and online. It reported the attack to police, the data regulator and the digital security authority.","source":"Sigmalive","url":"https://www.sigmalive.com/news/local/1296990/kataghghelia-apo-to-oghkologhiko-kentro-ghia-paranomi-dimosiefsi-dedomenon","archiveUrl":"https://web.archive.org/web/20261005163757/https://www.sigmalive.com/news/local/1296990/kataghghelia-apo-to-oghkologhiko-kentro-ghia-paranomi-dimosiefsi-dedomenon","theme":"breach","status":"admitted","id":"CYP-S005","pageUrl":"https://healthrecordrights.com/real-cases/#CYP-S005","countryUrl":"https://healthrecordrights.com/brief/cyprus/","why":"Stolen patient records can be published or sold, and patients cannot take them back.","sourceType":"journalism","lang":"el","providerName":"Ογκολογικό Κέντρο της Τράπεζας Κύπρου","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CZE","country":"Czechia","date":"2025-07-18","headline":"Court upholds fine on clinic that failed to report a patient data breach","paraphrase":"A cyberattack left a private clinic's patient records unreachable for a week. The clinic, holding data on about 250,000 patients, did not report it in time and could not prove it told patients. The court confirmed a 309,000 crown fine.","source":"oPojištění.cz (reporting a Supreme Administrative Court ruling of 21 May 2025)","url":"https://www.opojisteni.cz/legislativa/zkontrolujte-si-proces-pro-rizeni-incidentu-jinak-vam-hrozi-pokuta/c:29468/","archiveUrl":"https://web.archive.org/web/20261005163826/https://www.opojisteni.cz/legislativa/zkontrolujte-si-proces-pro-rizeni-incidentu-jinak-vam-hrozi-pokuta/c:29468/","theme":"breach","status":"finding","id":"CZE-S001","pageUrl":"https://healthrecordrights.com/real-cases/#CZE-S001","countryUrl":"https://healthrecordrights.com/brief/czechia/","why":"Patients can only protect themselves after a breach if the provider reports it and tells them promptly.","sourceType":"journalism","lang":"cs","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CZE","country":"Czechia","date":"2025-07-09","headline":"Hospital warns patients a ransomware attack may have exposed their record data","paraphrase":"After ransomware shut down its systems, a hospital told patients that personal data linked to their medical records may have been stolen. It could not yet confirm whether or how much was taken, and notified the data protection office.","source":"ČT24 (Česká televize)","url":"https://ct24.ceskatelevize.cz/clanek/domaci/pri-kyberutoku-na-nemocnici-nymburk-mohla-uniknout-data-pacientu-362785","archiveUrl":"https://web.archive.org/web/20261005163900/https://ct24.ceskatelevize.cz/clanek/domaci/pri-kyberutoku-na-nemocnici-nymburk-mohla-uniknout-data-pacientu-362785","theme":"breach","status":"admitted","id":"CZE-S002","pageUrl":"https://healthrecordrights.com/real-cases/#CZE-S002","countryUrl":"https://healthrecordrights.com/brief/czechia/","why":"When a hospital is hit, patients may never learn whether their records were taken or misused.","sourceType":"journalism","lang":"cs","providerName":"Nemocnice Nymburk","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CZE","country":"Czechia","date":"2026-09-14","headline":"Hackers offer a Czech health facility's patient records for sale","paraphrase":"A security firm reported that a hacking group stole a database from an unnamed Czech health facility and offered it for sale. It reportedly held patient contacts with health records, booking details with payment and insurance data, and staff profiles.","source":"Aktuálně.cz","url":"https://zpravy.aktualne.cz/ekonomika/hackeri-v-srpnu-odcizili-pacientska-data-zdravotnickeho-zarizeni-v-cesku/r~aaa29d5cab5ab9aa374fead6cec97e1a/","archiveUrl":"https://web.archive.org/web/20261005163929/https://zpravy.aktualne.cz/ekonomika/hackeri-v-srpnu-odcizili-pacientska-data-zdravotnickeho-zarizeni-v-cesku/r~aaa29d5cab5ab9aa374fead6cec97e1a/","theme":"breach","status":"alleged","id":"CZE-S003","pageUrl":"https://healthrecordrights.com/real-cases/#CZE-S003","countryUrl":"https://healthrecordrights.com/brief/czechia/","why":"A leaked health record cannot be reset like a password; it stays sensitive for life.","sourceType":"journalism","lang":"cs","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CZE","country":"Czechia","date":"2025-05-28","headline":"Hospital lost control of a computer holding examination images of about 1,900 patients","paraphrase":"A clinic computer storing images and data from nearly two thousand examinations disappeared for four days, then reappeared. The hospital's internal review called it a data incident, its director confirmed it, and it was reported to the data protection office.","source":"Seznam Zprávy","url":"https://www.seznamzpravy.cz/clanek/domaci-kauzy-intimni-snimky-pacientu-nic-se-nedeje-rika-exministr-o-zmizeni-pocitace-277656","archiveUrl":"https://web.archive.org/web/20261005164029/https://www.seznamzpravy.cz/clanek/domaci-kauzy-intimni-snimky-pacientu-nic-se-nedeje-rika-exministr-o-zmizeni-pocitace-277656","theme":"breach","status":"admitted","id":"CZE-S004","pageUrl":"https://healthrecordrights.com/real-cases/#CZE-S004","countryUrl":"https://healthrecordrights.com/brief/czechia/","why":"A device with sensitive images went missing for days; patients cannot know who saw them.","sourceType":"journalism","lang":"cs","providerName":"Fakultní nemocnice Královské Vinohrady","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"COD","country":"Democratic Republic of the Congo","date":"2026-02-27","headline":"Congo signs US health deal amid concern over who controls health data","paraphrase":"A Kinshasa outlet reports that Congo joined 14 African countries in US health deals that tie funding to expanded health data systems and fast reporting, while critics warn of lost control over health data and public trust.","source":"Mbote","url":"https://mbote.cd/actualites/la-rdc-et-14-autres-pays-africains-signent-un-accord-controverse-pour-les-donnees-de-sante-avec-les-usa/199387/","archiveUrl":"https://web.archive.org/web/20261005162524/https://mbote.cd/actualites/la-rdc-et-14-autres-pays-africains-signent-un-accord-controverse-pour-les-donnees-de-sante-avec-les-usa/199387/","theme":"sold_or_shared","status":"alleged","id":"COD-S001","pageUrl":"https://healthrecordrights.com/real-cases/#COD-S001","countryUrl":"https://healthrecordrights.com/brief/democratic-republic-of-the-congo/","why":"Deals like this can change who controls health data and samples drawn from patient care.","sourceType":"journalism","lang":"fr","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"DNK","country":"Denmark","date":"2026-03-27","headline":"Clinic told a patient abroad to fetch their record in person on USB","paraphrase":"A patient living outside Denmark asked a general practice for an electronic copy of their record. The clinic said it could only hand it over on a new USB stick the patient brought in person. The board criticised the clinic.","source":"Styrelsen for Patientklager (Danish Patient Complaints Board), 26SFP21","url":"https://www.stpk.dk/afgorelser-og-domme/afgorelser-fra-styrelsen-for-patientklager/26sfp21/","theme":"access_delay_or_cost","status":"finding","id":"DNK-S001","pageUrl":"https://healthrecordrights.com/real-cases/#DNK-S001","countryUrl":"https://healthrecordrights.com/brief/denmark/","why":"Patients who live abroad can be shut out of their own record if a clinic insists on collection in person.","sourceType":"regulator_decision","lang":"da","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"DNK","country":"Denmark","date":"2025-03-19","headline":"Women found in their access logs that a doctor had looked up their records","paraphrase":"Women checked the access log for their records on sundhed.dk and saw that a doctor with no part in their care had looked them up. The regions found many more unauthorised lookups and reported him to police.","source":"TV 2 Øst","url":"https://www.tv2east.dk/region-sjaelland/laege-snagede-i-journaler-fik-sit-livs-chok","archiveUrl":"https://web.archive.org/web/20261005164320/https://www.tv2east.dk/region-sjaelland/laege-snagede-i-journaler-fik-sit-livs-chok","theme":"breach","status":"admitted","id":"DNK-S002","pageUrl":"https://healthrecordrights.com/real-cases/#DNK-S002","countryUrl":"https://healthrecordrights.com/brief/denmark/","why":"The sundhed.dk access log let patients themselves catch misuse of their records.","sourceType":"journalism","lang":"da","providerName":"Region Sjælland and Region Hovedstaden","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"DNK","country":"Denmark","date":"2025-09-08","headline":"Millions of hospital records used for AI research without a prior risk check","paraphrase":"Experts said two regions gave a research project access to 3.65 million people's hospital records without first assessing data protection risks. A regional director said the analysis perhaps should have been done. The regulator opened an inquiry.","source":"DR","url":"https://www.dr.dk/nyheder/indland/datatilsynet-gaar-ind-i-sag-om-brug-af-millioner-af-danskeres-sygehusjournaler-til","archiveUrl":"https://web.archive.org/web/20261005164335/https://www.dr.dk/nyheder/indland/datatilsynet-gaar-ind-i-sag-om-brug-af-millioner-af-danskeres-sygehusjournaler-til","theme":"sold_or_shared","status":"alleged","id":"DNK-S003","pageUrl":"https://healthrecordrights.com/real-cases/#DNK-S003","countryUrl":"https://healthrecordrights.com/brief/denmark/","why":"Patients were not asked before their hospital records went into a research database.","sourceType":"journalism","lang":"da","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"DNK","country":"Denmark","date":"2025-01-21","headline":"Hackers posted patients' health details from a GP chain online","paraphrase":"After a cyberattack on a nationwide chain of GP practices, hackers posted patient information including illness history, hospital referrals and medication. The chain had confirmed personal data on an unknown number of patients was compromised.","source":"DR","url":"https://www.dr.dk/nyheder/indland/dybt-foelsomme-patientoplysninger-fra-alles-laegehus-laekket-online","archiveUrl":"https://web.archive.org/web/20261005164354/https://www.dr.dk/nyheder/indland/dybt-foelsomme-patientoplysninger-fra-alles-laegehus-laekket-online","theme":"breach","status":"admitted","id":"DNK-S004","pageUrl":"https://healthrecordrights.com/real-cases/#DNK-S004","countryUrl":"https://healthrecordrights.com/brief/denmark/","why":"Health details mixed with ID numbers can be used for fraud and extortion.","sourceType":"journalism","lang":"da","providerName":"Alles Lægehus","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"DNK","country":"Denmark","date":"2024-10-04","headline":"Regulator criticised a university for passing on research participants' health data without permission","paraphrase":"After inspecting eight research projects using health information, the data protection authority gave serious criticism: the university had several times passed personal data on without the required permission and supervised partners poorly. The university said it takes the criticism seriously.","source":"DR","url":"https://www.dr.dk/nyheder/seneste/efter-kritik-fra-datatilsynet-universitet-lover-passe-bedre-paa-folks","archiveUrl":"https://web.archive.org/web/20261005164412/https://www.dr.dk/nyheder/seneste/efter-kritik-fra-datatilsynet-universitet-lover-passe-bedre-paa-folks","theme":"sold_or_shared","status":"finding","id":"DNK-S005","pageUrl":"https://healthrecordrights.com/real-cases/#DNK-S005","countryUrl":"https://healthrecordrights.com/brief/denmark/","why":"Health data given to researchers still needs the legal permission; patients rely on that check.","sourceType":"journalism","lang":"da","providerName":"Aarhus Universitet","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"DMA","country":"Dominica","date":"2025-06-23","headline":"Hospitals authority investigates staff role after video of a patient spread online","paraphrase":"A video of a patient receiving hospital care circulated on social media. The hospitals authority called it a breach of privacy, condemned its sharing, and said staff found involved would face strict discipline.","source":"Q95 Radio (Dominica)","url":"https://www.q95da.com/news/dominica-hospitals-authority-dha-launches-an-investigation-into-the-circulation-of-a-video-on-social-media-showing-a-patient-in-a-vulnerable-condition-sparking-concern-about-patient-privacy-care-standards","archiveUrl":"https://web.archive.org/web/20261005164237/https://www.q95da.com/news/dominica-hospitals-authority-dha-launches-an-investigation-into-the-circulation-of-a-video-on-social-media-showing-a-patient-in-a-vulnerable-condition-sparking-concern-about-patient-privacy-care-standards","theme":"breach","status":"admitted","id":"DMA-S001","pageUrl":"https://healthrecordrights.com/real-cases/#DMA-S001","countryUrl":"https://healthrecordrights.com/brief/dominica/","why":"Shows how quickly confidential images taken during hospital care can leave the hospital, with no data protection law to fall back on.","sourceType":"journalism","lang":"en","providerName":"Dominica Hospitals Authority","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"DOM","country":"Dominican Republic","date":"2025-10-19","headline":"Insurer added a stranger as a patient's spouse to move her policy without consent","paraphrase":"A woman found her health insurance file listed an unknown man as her husband. The regulator fined the insurer, which moved 1,708 people onto its books without consent between 2023 and 2025 using invented family records.","source":"Diario Libre","url":"https://www.diariolibre.com/actualidad/salud/2025/10/19/ars-burlan-sistema-con-afiliaciones-falsas-y-sanciones-blandas/3281416","theme":"record_wrong","status":"finding","id":"DOM-S001","pageUrl":"https://healthrecordrights.com/real-cases/#DOM-S001","countryUrl":"https://healthrecordrights.com/brief/dominican-republic/","why":"Invented family links in an insurance file can switch a person's cover and expose their data without their knowledge.","sourceType":"journalism","lang":"es","providerName":"ARS APS","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"DOM","country":"Dominican Republic","date":"2026-09-23","headline":"Insured woman says her file was taken and her signature forged for fake claims","paraphrase":"A health insurance member has sued doctors and former insurer staff, saying they pulled her file from a confidential database and forged her signature to bill for procedures she never received.","source":"Diario Libre","url":"https://www.diariolibre.com/actualidad/justicia/2026/09/23/afiliada-al-senasa-se-querella-contra-medicos-y-empleados-de-esa-ars/3668287","theme":"breach","status":"alleged","id":"DOM-S002","pageUrl":"https://healthrecordrights.com/real-cases/#DOM-S002","countryUrl":"https://healthrecordrights.com/brief/dominican-republic/","why":"When insider access to a confidential member file goes unchecked, a person's identity can be used to bill for care never given.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"DOM","country":"Dominican Republic","date":"2026-09-18","headline":"Prosecutors say ex-insurer staff used members' real data to file thousands of false claims","paraphrase":"Prosecutors say former staff of a health insurer took confidential member data and filed 4,363 authorizations for services members never sought. Interviewed members said they never requested, signed or received them.","source":"Diario Libre","url":"https://www.diariolibre.com/actualidad/justicia/2026/09/18/senasa-20-medicos-cobraban-servicios-que-nunca-prestaron/3663468","theme":"record_wrong","status":"alleged","id":"DOM-S003","pageUrl":"https://healthrecordrights.com/real-cases/#DOM-S003","countryUrl":"https://healthrecordrights.com/brief/dominican-republic/","why":"False entries filed under real members' names leave their insurance records showing services they never asked for.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ECU","country":"Ecuador","date":"2025-04-21","headline":"Court finds clinic ignored order to hand a patient copies of her own record","paraphrase":"A patient won a data access case ordering a dental clinic to give her certified copies of her record. The clinic did not comply. The Constitutional Court found it in breach, ordered delivery, a public apology and possible fines.","source":"Corte Constitucional del Ecuador","url":"https://www.corteconstitucional.gob.ec/incumplimiento-de-la-sentencia-de-habeas-data-por-parte-de-un-centro-odontologico/","archiveUrl":"https://web.archive.org/web/20261005164735/https://www.corteconstitucional.gob.ec/incumplimiento-de-la-sentencia-de-habeas-data-por-parte-de-un-centro-odontologico/","theme":"access_refused","status":"finding","id":"ECU-S001","pageUrl":"https://healthrecordrights.com/real-cases/#ECU-S001","countryUrl":"https://healthrecordrights.com/brief/ecuador/","why":"Even after winning in court, a patient still had to go back to the highest court to get her own record.","sourceType":"court_judgment","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ECU","country":"Ecuador","date":"2026-06-13","headline":"Report says millions of public health records, including clinical histories, were taken","paraphrase":"A newspaper reports that an attacker allegedly took 14.8 million records and 10.6 million photos from the public health system in 2025, including clinical histories and emergency forms, later passed off as civil registry data.","source":"Extra","url":"https://www.extra.ec/noticia/premium/robo-datos-ecuador-sistemas-siguen-siendo-vulnerables-155958.html","archiveUrl":"https://web.archive.org/web/20261005164911/https://www.extra.ec/noticia/premium/robo-datos-ecuador-sistemas-siguen-siendo-vulnerables-155958.html","theme":"breach","status":"alleged","id":"ECU-S003","pageUrl":"https://healthrecordrights.com/real-cases/#ECU-S003","countryUrl":"https://healthrecordrights.com/brief/ecuador/","why":"Clinical histories and emergency forms are among the most sensitive records a person has.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"EGY","country":"Egypt","date":"2026-08-27","headline":"Lawmaker asks why some hospital patients cannot get their full medical files","paraphrase":"A member of parliament told the health minister that patients at some public hospitals leave with only a final summary, not detailed reports and test results, and some are stopped from photographing their own records.","source":"Cairo 24","url":"https://www.cairo24.com/2484087","archiveUrl":"https://web.archive.org/web/20261005164924/https://www.cairo24.com/2484087","theme":"access_refused","status":"alleged","id":"EGY-S001","pageUrl":"https://healthrecordrights.com/real-cases/#EGY-S001","countryUrl":"https://healthrecordrights.com/brief/egypt/","why":"Without the full file, a patient cannot check their care or prove a complaint.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"EGY","country":"Egypt","date":"2025-01-19","headline":"Lawmaker raises claims that some medical labs misused patients' data","paraphrase":"In a formal request to the health minister, a member of parliament cited press reports that some laboratories had used patients' data unlawfully, and asked for regular oversight to stop misuse of patient data. No finding was reported.","source":"Darb","url":"https://daaarb.com/%D8%AA%D8%AD%D8%B1%D9%83-%D8%A8%D8%B1%D9%84%D9%85%D8%A7%D9%86%D9%8A-%D8%B9%D9%86-%D8%A7%D8%AD%D8%AA%D9%83%D8%A7%D8%B1-%D8%AB%D9%84%D8%A7%D8%AB-%D9%85%D8%B9%D8%A7%D9%85%D9%84-%D8%AA%D8%AD%D8%A7%D9%84/","archiveUrl":"https://web.archive.org/web/20261005164952/https://daaarb.com/%D8%AA%D8%AD%D8%B1%D9%83-%D8%A8%D8%B1%D9%84%D9%85%D8%A7%D9%86%D9%8A-%D8%B9%D9%86-%D8%A7%D8%AD%D8%AA%D9%83%D8%A7%D8%B1-%D8%AB%D9%84%D8%A7%D8%AB-%D9%85%D8%B9%D8%A7%D9%85%D9%84-%D8%AA%D8%AD%D8%A7%D9%84/","theme":"other","status":"alleged","id":"EGY-S002","pageUrl":"https://healthrecordrights.com/real-cases/#EGY-S002","countryUrl":"https://healthrecordrights.com/brief/egypt/","why":"Lab results are among the most sensitive data a patient hands over.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"EGY","country":"Egypt","date":"2025-04-27","headline":"Disciplinary court suspends public hospital doctor who disclosed patients' confidential medical data","paraphrase":"A disciplinary court suspended a public hospital doctor for six months. Prosecutors found she disclosed confidential medical information about patients online without their or the hospital's permission, and used patient information to promote clinics.","source":"Youm7","url":"https://www.youm7.com/story/2025/4/27/11-%D9%85%D8%AE%D8%A7%D9%84%D9%81%D8%A9-%D9%82%D8%A7%D8%AF%D8%AA-%D8%B7%D8%A8%D9%8A%D8%A8%D8%A9-%D9%83%D9%81%D8%B1-%D8%A7%D9%84%D8%AF%D9%88%D8%A7%D8%B1-%D9%85%D9%86-%D8%A7%D9%84%D8%B4%D9%87%D8%B1%D8%A9-%D9%84%D9%84%D9%88%D9%82%D9%81-%D8%B9%D9%86/6967597","theme":"breach","status":"finding","id":"EGY-S003","pageUrl":"https://healthrecordrights.com/real-cases/#EGY-S003","countryUrl":"https://healthrecordrights.com/brief/egypt/","why":"Details patients give in confidence at a public hospital were posted online without their permission.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SLV","country":"El Salvador","date":"2026-08-26","headline":"Doctors' union says social security computer failures are slowing electronic records and care","paraphrase":"A health workers' union reported a week of slowdowns and failures in the social security institute's computer system, affecting electronic records, prescriptions and lab orders and delaying patients. The institute had not responded.","source":"Diario El Mundo","url":"https://diario.elmundo.sv/nacionales/simetrisss-denuncia-fallas-en-sistema-informatico-del-isss-y-retrasos-en-atencion-a-pacientes","theme":"other","status":"alleged","id":"SLV-S001","pageUrl":"https://healthrecordrights.com/real-cases/#SLV-S001","countryUrl":"https://healthrecordrights.com/brief/el-salvador/","why":"When the record system stalls, insured patients wait longer for consultations, tests and prescriptions.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SLV","country":"El Salvador","date":"2026-07-20","headline":"Family refused a relative's medical record on privacy grounds while she could not consent","paraphrase":"A family asked the health authority for an adult relative's medical record. It refused, citing confidentiality and the data law, although the patient was not in a position to sign the authorisation it required.","source":"Revista Factum","url":"https://www.revistafactum.com/gobierno-oculta-ruthlopez/","theme":"access_refused","status":"alleged","id":"SLV-S002","pageUrl":"https://healthrecordrights.com/real-cases/#SLV-S002","countryUrl":"https://healthrecordrights.com/brief/el-salvador/","why":"A patient who cannot sign an authorisation may leave relatives with no lawful way to learn what care she received.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SLV","country":"El Salvador","date":"2026-06-26","headline":"Health coalition says paper records from a rebuilt public hospital cannot be found","paraphrase":"A health rights coalition said the paper records of patients treated before a national hospital was rebuilt and moved to a new hospital network have disappeared, so earlier test results are unavailable and some studies may need repeating.","source":"Diario Co Latino","url":"https://www.diariocolatino.com/conadesa-denuncia-desaparicion-de-expedientes-clinicos-del-hospital-rosales/","theme":"lost_between_providers","status":"alleged","id":"SLV-S003","pageUrl":"https://healthrecordrights.com/real-cases/#SLV-S003","countryUrl":"https://healthrecordrights.com/brief/el-salvador/","why":"Lost records break continuity of care and can force patients to repeat invasive tests.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SLV","country":"El Salvador","date":"2026-04-23","headline":"Unclear terms for a tech firm's use of patient data in state health app","paraphrase":"Reporting on the state's AI telemedicine app found no public agreement setting out how the cloud technology partner may use patients' data. The company said the data belong to the client and did not say whether it is paid.","source":"BBC News Mundo","url":"https://www.bbc.com/mundo/articles/cd0r82jg7d2o","theme":"other","status":"alleged","id":"SLV-S004","pageUrl":"https://healthrecordrights.com/real-cases/#SLV-S004","countryUrl":"https://healthrecordrights.com/brief/el-salvador/","why":"Patients using the state app cannot see what the cloud provider may do with their health records.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SLV","country":"El Salvador","date":"2025-07-04","headline":"Doctors report failures as ministry and social security merge patient records","paraphrase":"As the health ministry's new information system was joined to the social security institute's electronic record, a doctors' union said the rollout came without training or coordination and the new system had shown multiple failures.","source":"El Diario de Hoy (elsalvador.com)","url":"https://www.elsalvador.com/h-noticias/h-nacional/ministerio-de-salud-isss-centros-comision-/1228840/2025/","theme":"other","status":"alleged","id":"SLV-S005","pageUrl":"https://healthrecordrights.com/real-cases/#SLV-S005","countryUrl":"https://healthrecordrights.com/brief/el-salvador/","why":"A shared record only helps patients if it works; staff describe trial and error during the switch.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"GNQ","country":"Equatorial Guinea","date":"2024-10-24","headline":"Governor rebukes hospital staff after video of a patient during care spread online","paraphrase":"Health workers reportedly filmed a patient during treatment and the video circulated on social media. A provincial governor told staff they must keep professional secrecy and asked managers to identify who made it.","source":"Real Equatorial Guinea","url":"https://realequatorialguinea.com/salud/indignacion-por-un-video-difundido-del-hospital-de-evinayong-donde-se-trata-a-un-paciente-herido/","archiveUrl":"https://web.archive.org/web/20261005171216/https://realequatorialguinea.com/salud/indignacion-por-un-video-difundido-del-hospital-de-evinayong-donde-se-trata-a-un-paciente-herido/","theme":"breach","status":"alleged","id":"GNQ-S001","pageUrl":"https://healthrecordrights.com/real-cases/#GNQ-S001","countryUrl":"https://healthrecordrights.com/brief/equatorial-guinea/","why":"Images taken during care are private health information, and with no working data regulator patients have little recourse.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"EST","country":"Estonia","date":"2025-12-05","headline":"Provider ignored a patient's request to correct entries in the national health system","paraphrase":"A patient asked a provider to correct data it had sent to the national health system. The provider said the entries were right and would not discuss it. The audit office said this broke the provider's complaints rules.","source":"Riigikontroll (National Audit Office of Estonia), report to the Riigikogu","url":"https://www.riigikontroll.ee/sites/default/files/documents/2025-12/19886_RKTR_6609_2-1.4_2352_002-1.pdf","archiveUrl":"https://web.archive.org/web/20261005165229/https://www.riigikontroll.ee/sites/default/files/documents/2025-12/19886_RKTR_6609_2-1.4_2352_002-1.pdf","theme":"record_wrong","status":"finding","id":"EST-S002","pageUrl":"https://healthrecordrights.com/real-cases/#EST-S002","countryUrl":"https://healthrecordrights.com/brief/estonia/","why":"Patients cannot edit their own national record; if the provider will not engage, wrong entries stay.","sourceType":"regulator_decision","lang":"et","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"EST","country":"Estonia","date":"2025-12-05","headline":"Patient found portal entries from a doctor they were not registered with","paraphrase":"Checking the national patient portal, a patient found that a family doctor whose list they were not on had recorded a diagnosis and treatment for them. The audit office warned that a misleading history can affect later care decisions.","source":"Riigikontroll (National Audit Office of Estonia), report to the Riigikogu","url":"https://www.riigikontroll.ee/sites/default/files/documents/2025-12/19886_RKTR_6609_2-1.4_2352_002-1.pdf","archiveUrl":"https://web.archive.org/web/20261005165229/https://www.riigikontroll.ee/sites/default/files/documents/2025-12/19886_RKTR_6609_2-1.4_2352_002-1.pdf","theme":"record_wrong","status":"finding","id":"EST-S003","pageUrl":"https://healthrecordrights.com/real-cases/#EST-S003","countryUrl":"https://healthrecordrights.com/brief/estonia/","why":"The patient portal lets people spot entries that belong to someone else.","sourceType":"regulator_decision","lang":"et","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"EST","country":"Estonia","date":"2025-12-05","headline":"One wrong letter in a code put a false diagnosis on record","paraphrase":"For years, documents sent to the national system carried a diagnosis code one letter away from the right one, recording an unrelated finding. The audit office noted such errors can mislead treatment and harm a person's reputation and job prospects.","source":"Riigikontroll (National Audit Office of Estonia), report to the Riigikogu","url":"https://www.riigikontroll.ee/sites/default/files/documents/2025-12/19886_RKTR_6609_2-1.4_2352_002-1.pdf","archiveUrl":"https://web.archive.org/web/20261005165229/https://www.riigikontroll.ee/sites/default/files/documents/2025-12/19886_RKTR_6609_2-1.4_2352_002-1.pdf","theme":"record_wrong","status":"finding","id":"EST-S004","pageUrl":"https://healthrecordrights.com/real-cases/#EST-S004","countryUrl":"https://healthrecordrights.com/brief/estonia/","why":"A coding slip can follow a patient into jobs that check health data.","sourceType":"regulator_decision","lang":"et","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"EST","country":"Estonia","date":"2026-09-03","headline":"Patient health data downloaded from a dental records system used by 300 providers","paraphrase":"Someone repeatedly entered a records system used by over 300 Estonian dental and health providers and downloaded patients' ID codes, emails and health data. Police arrested a suspect; prosecutors said the data appears not to have been shared.","source":"ERR","url":"https://www.err.ee/1610127001/hambaarstide-infosusteemist-lekkisid-patsientide-terviseandmed","archiveUrl":"https://web.archive.org/web/20261005165320/https://www.err.ee/1610127001/hambaarstide-infosusteemist-lekkisid-patsientide-terviseandmed","theme":"breach","status":"alleged","id":"EST-S005","pageUrl":"https://healthrecordrights.com/real-cases/#EST-S005","countryUrl":"https://healthrecordrights.com/brief/estonia/","why":"One supplier's system can hold records from hundreds of practices at once.","sourceType":"journalism","lang":"et","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"SWZ","country":"Eswatini","date":"2026-09-08","headline":"Deaf patients say hospitals without interpreters force them to share health details with others","paraphrase":"Deaf patients told investigative reporters that public hospitals rarely provide sign language interpreters, so relatives or strangers relay what clinicians say. They said this strips them of privacy and risks errors in what they are told.","source":"Inhlase Centre for Investigative Journalism","url":"https://inhlase.com/deaf-patients-left-in-dangerous-silence-in-eswatinis-hospitals/","theme":"other","status":"self_reported","id":"SWZ-S001","pageUrl":"https://healthrecordrights.com/real-cases/#SWZ-S001","countryUrl":"https://healthrecordrights.com/brief/eswatini/","why":"Without interpreters, deaf patients lose control over who hears their health information.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SWZ","country":"Eswatini","date":"2026-08-19","headline":"Eswatini signs US health funding deal amid concern over sharing health data","paraphrase":"Eswatini signed a US health funding agreement that, under the wider scheme, trades funding for access to pathogen samples and surveillance data. Critics warned the deal could expose the country's health data to abuse.","source":"APAnews (African Press Agency)","url":"https://apanews.net/eswatini-signs-195m-us-health-deal-amid-data-sharing-concerns/","theme":"sold_or_shared","status":"alleged","id":"SWZ-S002","pageUrl":"https://healthrecordrights.com/real-cases/#SWZ-S002","countryUrl":"https://healthrecordrights.com/brief/eswatini/","why":"Aid tied to access to surveillance data raises questions about who controls Emaswati's health data.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"FJI","country":"Fiji","date":"2025-08-03","headline":"Hospital staff allegedly opened a patient's records without a care reason","paraphrase":"The outlet reports indications that several staff at a public hospital opened a patient's medical records without a care reason. The hospital operator said patient confidentiality is of the utmost importance.","source":"fijivillage","url":"https://www.fijivillage.com/news/A-number-of-medical-staff-allegedly-access-medical-records-of-Aiyaz-Sayed-Khaiyum-845frx/","archiveUrl":"https://web.archive.org/web/20261005165607/https://www.fijivillage.com/news/A-number-of-medical-staff-allegedly-access-medical-records-of-Aiyaz-Sayed-Khaiyum-845frx/","theme":"breach","status":"alleged","id":"FJI-S001","pageUrl":"https://healthrecordrights.com/real-cases/#FJI-S001","countryUrl":"https://healthrecordrights.com/brief/fiji/","why":"Staff browsing a record out of curiosity breaks the confidentiality every patient relies on.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"FIN","country":"Finland","date":"2025-02-10","headline":"Provider said its system could not show who opened a patient's record and when","paraphrase":"A patient asked a health provider for log data showing who had viewed their records over two years, with times and reasons. The provider said its system could not produce usable logs. The deputy ombudsman ordered it to supply them.","source":"Tietosuojavaltuutettu (Office of the Data Protection Ombudsman), decision TSV/1507/2024","url":"https://www.edilex.fi/tsv/20252464","archiveUrl":"https://web.archive.org/web/20261005165345/https://www.edilex.fi/tsv/20252464","theme":"access_refused","status":"finding","id":"FIN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#FIN-S001","countryUrl":"https://healthrecordrights.com/brief/finland/","why":"Patients have a right to see who looked at their record; a clumsy log system is no excuse.","sourceType":"regulator_decision","lang":"fi","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"FIN","country":"Finland","date":"2026-07-13","headline":"Sentence final for hacker who published about 33,000 people's patient records","paraphrase":"An attacker broke into a private health provider's system, downloaded its patient database and published the data of about 33,000 people online. The Supreme Court refused his appeal, so the appeal court's sentence of six years and 11 months stands.","source":"Yle","url":"https://yle.fi/a/74-20236144","archiveUrl":"https://web.archive.org/web/20261005165409/https://yle.fi/a/74-20236144","theme":"breach","status":"finding","id":"FIN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#FIN-S002","countryUrl":"https://healthrecordrights.com/brief/finland/","why":"Stolen records were posted online and used for blackmail; the criminal case is now closed.","sourceType":"journalism","lang":"fi","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"FIN","country":"Finland","date":"2025-09-24","headline":"Patient's log request revealed two staff had viewed about 150 people's records","paraphrase":"A patient obtained the log of who had opened their record and reported it to police. The wellbeing region found two employees had viewed nearly 150 people's records without a care relationship, and its chief medical officer apologised.","source":"Yle","url":"https://yle.fi/a/74-20184732","archiveUrl":"https://web.archive.org/web/20261005165433/https://yle.fi/a/74-20184732","theme":"breach","status":"admitted","id":"FIN-S003","pageUrl":"https://healthrecordrights.com/real-cases/#FIN-S003","countryUrl":"https://healthrecordrights.com/brief/finland/","why":"Asking for your access log is how this was caught; the region apologised.","sourceType":"journalism","lang":"fi","providerName":"Keski-Suomen hyvinvointialue (Central Finland Wellbeing Services County)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"FIN","country":"Finland","date":"2026-09-28","headline":"About 50 health workers charged with unlawfully reading one patient's record","paraphrase":"About 50 nurses and doctors are charged with unlawfully reading one patient's record with no part in his care. He learned of it when a staff member mentioned details of his care. He said he lost faith in healthcare.","source":"Yle","url":"https://yle.fi/a/74-20248250","archiveUrl":"https://web.archive.org/web/20261005165541/https://yle.fi/a/74-20248250","theme":"breach","status":"alleged","id":"FIN-S004","pageUrl":"https://healthrecordrights.com/real-cases/#FIN-S004","countryUrl":"https://healthrecordrights.com/brief/finland/","why":"Staff can read a record with no part in the patient's care; here dozens are charged over one patient's file.","sourceType":"journalism","lang":"fi","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"FIN","country":"Finland","date":"2026-02-11","headline":"Doctors in a university study say the capital region's record system buries patient information","paraphrase":"In interviews for a university study, 25 doctors said the region's patient record system makes information hard to find, slows their work and endangers patient safety, and that their correction requests often go unanswered.","source":"Helsingin Sanomat","url":"https://www.hs.fi/helsinki/art-2000011807677.html","theme":"other","status":"alleged","id":"FIN-S005","pageUrl":"https://healthrecordrights.com/real-cases/#FIN-S005","countryUrl":"https://healthrecordrights.com/brief/finland/","why":"If clinicians cannot find what is in the record, patients' history is effectively missing at the point of care.","sourceType":"journalism","lang":"fi","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"FRA","country":"France","date":"2026-02-13","headline":"Top court upholds fine over patient data passed on without true anonymisation","paraphrase":"Doctors' software gathered patients' health data, such as prescriptions and sick leave, with identifiers that allowed care pathways to be traced. The court agreed the data were not anonymous and rejected the company's challenge to an 800,000 euro fine.","source":"Conseil d'État","url":"https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2026-02-13/498628","archiveUrl":"https://web.archive.org/web/20261005165719/https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2026-02-13/498628","theme":"sold_or_shared","status":"finding","id":"FRA-S001","pageUrl":"https://healthrecordrights.com/real-cases/#FRA-S001","countryUrl":"https://healthrecordrights.com/brief/france/","why":"Records collected through doctors' software were reused for studies, and the court found patients could be singled out.","sourceType":"court_judgment","lang":"fr","providerName":"Cegedim Santé","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"FRA","country":"France","date":"2025-02-20","headline":"Court backs family's right to see hospital's adverse-event report on a relative","paraphrase":"A hospital refused to give a relative the serious adverse-event report it filed after a patient died. The courts ordered release of the parts about his health and care, and the hospital's appeal was rejected.","source":"Conseil d'État","url":"https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2025-02-20/493519","archiveUrl":"https://web.archive.org/web/20261005165745/https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2025-02-20/493519","theme":"access_refused","status":"finding","id":"FRA-S002","pageUrl":"https://healthrecordrights.com/real-cases/#FRA-S002","countryUrl":"https://healthrecordrights.com/brief/france/","why":"Families can be refused papers that explain a death in care; courts may order the health parts released.","sourceType":"court_judgment","lang":"fr","providerName":"Centre hospitalier universitaire de Rennes","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"FRA","country":"France","date":"2024-11-19","headline":"Hospital records of about 750,000 people posted online after stolen login used","paraphrase":"A hacker posted a database of about 758,000 people taken from hospital management software, including contact details, treating doctor, prescriptions and death declarations. The software maker said a privileged account at a client hospital was misused.","source":"Clubic","url":"https://www.clubic.com/actualite-544139-fichiers-et-dossiers-patients-sensibles-francais-en-fuite-sur-le-dark-web-que-se-passe-t-il.html","archiveUrl":"https://web.archive.org/web/20261005165808/https://www.clubic.com/actualite-544139-fichiers-et-dossiers-patients-sensibles-francais-en-fuite-sur-le-dark-web-que-se-passe-t-il.html","theme":"breach","status":"admitted","id":"FRA-S004","pageUrl":"https://healthrecordrights.com/real-cases/#FRA-S004","countryUrl":"https://healthrecordrights.com/brief/france/","why":"One stolen staff login was enough to pull health details on hundreds of thousands of patients.","sourceType":"journalism","lang":"fr","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"FRA","country":"France","date":"2026-02-27","headline":"Doctors' private notes on patients exposed in attack on medical software","paraphrase":"Attackers reached files of 1,500 doctors using one practice software. Administrative data on 15 million patients leaked, and the health minister said sensitive doctor annotations on 164,000 patients were exposed. The vendor said structured medical records were intact.","source":"franceinfo","url":"https://www.franceinfo.fr/internet/securite-sur-internet/cyberattaques/quinze-millions-de-patients-concernes-1-500-medecins-vises-une-enquete-ouverte-ce-que-l-on-sait-de-la-cyberattaque-qui-a-cible-un-logiciel-medical_7833611.html","archiveUrl":"https://web.archive.org/web/20261005165918/https://www.franceinfo.fr/internet/securite-sur-internet/cyberattaques/quinze-millions-de-patients-concernes-1-500-medecins-vises-une-enquete-ouverte-ce-que-l-on-sait-de-la-cyberattaque-qui-a-cible-un-logiciel-medical_7833611.html","theme":"breach","status":"admitted","id":"FRA-S005","pageUrl":"https://healthrecordrights.com/real-cases/#FRA-S005","countryUrl":"https://healthrecordrights.com/brief/france/","why":"Free-text notes doctors type about patients can leak, and they can be the most intimate part of a file.","sourceType":"journalism","lang":"fr","providerName":"Cegedim Santé","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"FRA","country":"France","date":"2026-03-30","headline":"Lab network says attackers reached patient analysis reports and social security numbers","paraphrase":"A national lab network reported unauthorised access, through a server run by an outside IT supplier, to patient names, emails, encrypted passwords, analysis reports and social security numbers. It was the network's second attack in about a year.","source":"Le Moniteur des pharmacies","url":"https://www.lemoniteurdespharmacies.fr/business/numerique/digitalisation/cerballiance-une-cyberattaque-expose-les-donnees-de-millions-de-patients","archiveUrl":"https://web.archive.org/web/20261005165944/https://www.lemoniteurdespharmacies.fr/business/numerique/digitalisation/cerballiance-une-cyberattaque-expose-les-donnees-de-millions-de-patients","theme":"breach","status":"admitted","id":"FRA-S006","pageUrl":"https://healthrecordrights.com/real-cases/#FRA-S006","countryUrl":"https://healthrecordrights.com/brief/france/","why":"Lab results sit outside the doctor's file, often with outside IT suppliers who can be the weak point.","sourceType":"journalism","lang":"fr","providerName":"Cerballiance","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"FRA","country":"France","date":"2026-09-04","headline":"Regulator fines private hospital after attacker reached hundreds of thousands of patient records","paraphrase":"France's data regulator fined a private hospital 500,000 euros after an attacker used one compromised account to reach data on 524,867 patients, some including health data. Access needed no multifactor login and suspicious activity went undetected.","source":"Génération NT","url":"https://www.generation-nt.com/actualites/fuite-donnees-hopitel-prive-loire-sanction-cnil-2080656","archiveUrl":"https://web.archive.org/web/20261005170055/https://www.generation-nt.com/actualites/fuite-donnees-hopitel-prive-loire-sanction-cnil-2080656","theme":"breach","status":"finding","id":"FRA-S007","pageUrl":"https://healthrecordrights.com/real-cases/#FRA-S007","countryUrl":"https://healthrecordrights.com/brief/france/","why":"Weak login and access controls let one stolen account open every patient's electronic record at a hospital.","sourceType":"journalism","lang":"fr","providerName":"Hôpital Privé de la Loire","lastVerified":"2026-10-04","addedOn":"2026-10-04","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GEO","country":"Georgia","date":"2025-04-01","headline":"Regulator rules clinic broke the law when its director posted a patient's X-ray online","paraphrase":"The clinic's director published a patient's X-ray image on her personal social media page. On the patient's complaint, the data protection regulator found the clinic processed health data unlawfully, issued a warning and ordered the post removed.","source":"Netgazeti","url":"https://netgazeti.ge/news/769528/","archiveUrl":"https://web.archive.org/web/20261005170646/https://netgazeti.ge/news/769528/","theme":"sold_or_shared","status":"finding","id":"GEO-S001","pageUrl":"https://healthrecordrights.com/real-cases/#GEO-S001","countryUrl":"https://healthrecordrights.com/brief/georgia/","why":"A clinic leader put a patient's scan on public social media; the penalty was only a warning.","sourceType":"journalism","lang":"ka","providerName":"Vivamedi (ვივამედი)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GEO","country":"Georgia","date":"2025-02-28","headline":"Ombudsman finds patients' medical files at an inpatient clinic nearly empty","paraphrase":"On a monitoring visit, the Public Defender's team found the clinic's patient files held almost no entries and often lacked lab results and specialist notes. It tied the gaps to overworked doctors and staff shortages.","source":"Public Defender (Ombudsman) of Georgia, National Preventive Mechanism","url":"https://ombudsman.ge/res/docs/2025022818032187661.pdf","archiveUrl":"https://web.archive.org/web/20261005170708/https://ombudsman.ge/res/docs/2025022818032187661.pdf","theme":"record_wrong","status":"finding","id":"GEO-S002","pageUrl":"https://healthrecordrights.com/real-cases/#GEO-S002","countryUrl":"https://healthrecordrights.com/brief/georgia/","why":"If the chart is blank, the next doctor, the patient and any reviewer have no record of the care given.","sourceType":"regulator_decision","lang":"ka","providerName":"East Georgia Mental Health Centre LLC (შპს „აღმოსავლეთ საქართველოს ფსიქიკური ჯანმრთელობის ცენტრი“)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"DEU","country":"Germany","date":"2025-05-20","headline":"Practices answered online reviews by publishing patients' names and record details","paraphrase":"Patients left anonymous negative reviews online. Medical practices replied in public, naming the patients and disclosing details from their records. The state regulator listed these among cases where it imposed fines in 2024.","source":"Hessian Commissioner for Data Protection and Freedom of Information (HBDI)","url":"https://datenschutz.hessen.de/presse/hbdi-stellt-taetigkeitsberichte-zum-datenschutz-und-zur-informationsfreiheit-fuer-das-jahr-2024-vor","archiveUrl":"https://web.archive.org/web/20261005164109/https://datenschutz.hessen.de/presse/hbdi-stellt-taetigkeitsberichte-zum-datenschutz-und-zur-informationsfreiheit-fuer-das-jahr-2024-vor","theme":"sold_or_shared","status":"finding","id":"DEU-S001","pageUrl":"https://healthrecordrights.com/real-cases/#DEU-S001","countryUrl":"https://healthrecordrights.com/brief/germany/","why":"What you tell a doctor can end up in public if a practice is angry at a review; the regulator fined it.","sourceType":"regulator_decision","lang":"de","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"DEU","country":"Germany","date":"2025-05-20","headline":"Practice manager took patient files home where guests could read them","paraphrase":"The state regulator reported a practice manager who took patient records home and left them unsecured, where party guests could see them, and who also sent photos of patient files to a partner by messaging app.","source":"Hessian Commissioner for Data Protection and Freedom of Information (HBDI)","url":"https://datenschutz.hessen.de/presse/hbdi-stellt-taetigkeitsberichte-zum-datenschutz-und-zur-informationsfreiheit-fuer-das-jahr-2024-vor","archiveUrl":"https://web.archive.org/web/20261005164109/https://datenschutz.hessen.de/presse/hbdi-stellt-taetigkeitsberichte-zum-datenschutz-und-zur-informationsfreiheit-fuer-das-jahr-2024-vor","theme":"breach","status":"finding","id":"DEU-S002","pageUrl":"https://healthrecordrights.com/real-cases/#DEU-S002","countryUrl":"https://healthrecordrights.com/brief/germany/","why":"Paper and phone copies of records can leave the practice without the patient ever knowing.","sourceType":"regulator_decision","lang":"de","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"DEU","country":"Germany","date":"2025-10-24","headline":"Man switching insurers found diagnoses in his ePA that he says he never had","paraphrase":"Seeking private insurance, a man opened his electronic patient record and found three diagnoses he says do not apply to him, billed during routine visits. Insurers saw him as high risk. Only the treating doctor can correct them.","source":"t-online","url":"https://www.t-online.de/gesundheit/aktuelles/id_100965028/elektronische-patientenakte-epa-versicherte-entdecken-falsche-diagnosen.html","archiveUrl":"https://web.archive.org/web/20261005164124/https://www.t-online.de/gesundheit/aktuelles/id_100965028/elektronische-patientenakte-epa-versicherte-entdecken-falsche-diagnosen.html","theme":"record_wrong","status":"self_reported","id":"DEU-S003","pageUrl":"https://healthrecordrights.com/real-cases/#DEU-S003","countryUrl":"https://healthrecordrights.com/brief/germany/","why":"Wrong entries in the ePA can raise insurance costs, and only the doctor who made them can remove them.","sourceType":"journalism","lang":"de","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"DEU","country":"Germany","date":"2025-07-21","headline":"Hospital group says patient data may have been taken in a cyberattack","paraphrase":"After an attack disrupted all its German facilities, a hospital group said data on patients, staff and partners may have been accessed without authorisation and could be misused or passed to others.","source":"heise online","url":"https://www.heise.de/news/Hacker-Angriff-auf-Kliniken-Moeglicherweise-Patientendaten-betroffen-10495015.html","archiveUrl":"https://web.archive.org/web/20261005164148/https://www.heise.de/news/Hacker-Angriff-auf-Kliniken-Moeglicherweise-Patientendaten-betroffen-10495015.html","theme":"breach","status":"admitted","id":"DEU-S004","pageUrl":"https://healthrecordrights.com/real-cases/#DEU-S004","countryUrl":"https://healthrecordrights.com/brief/germany/","why":"An attack on one hospital chain can reach the records of patients at many sites.","sourceType":"journalism","lang":"de","providerName":"Ameos","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"DEU","country":"Germany","date":"2025-02-20","headline":"Former patient found a rehab app exposed medical reports without a login","paraphrase":"A former patient noticed a rehabilitation provider's app talked to its servers unencrypted, and that patient files, including medical reports, could be opened without authentication. The provider said the gap was closed and it saw no sign of data outflow.","source":"c't (heise)","url":"https://www.heise.de/select/ct/2025/5/2503112000914901106","archiveUrl":"https://web.archive.org/web/20261005164213/https://www.heise.de/select/ct/2025/5/2503112000914901106","theme":"breach","status":"alleged","id":"DEU-S005","pageUrl":"https://healthrecordrights.com/real-cases/#DEU-S005","countryUrl":"https://healthrecordrights.com/brief/germany/","why":"Patients' own discoveries are often what expose these gaps.","sourceType":"journalism","lang":"de","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GHA","country":"Ghana","date":"2025-10-27","headline":"Record system vendor blames unrenewed contract for hospital disruptions","paraphrase":"The system's project manager said the contract expired in 2024 and an extension never came, leaving the project uncertain. Hospitals reverted to manual records and patients reported longer waits; the insurer told facilities to use a phone-based workaround.","source":"Adom Online (Multimedia Group)","url":"https://www.adomonline.com/hospitals-return-to-manual-records-as-lhims-contract-stalls/","archiveUrl":"https://web.archive.org/web/20261005170824/https://www.adomonline.com/hospitals-return-to-manual-records-as-lhims-contract-stalls/","theme":"other","status":"alleged","id":"GHA-S002","pageUrl":"https://healthrecordrights.com/real-cases/#GHA-S002","countryUrl":"https://healthrecordrights.com/brief/ghana/","why":"Patients' digital records can depend on a private contract that nobody renews on time.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GHA","country":"Ghana","date":"2025-10-29","headline":"Data Protection Commission opens investigation into handling of national patient records","paraphrase":"After a dispute over a shutdown of the national electronic records system, the regulator said it would assess how patient data is stored, retained and secured, and whether patients' rights are protected. No findings were reported.","source":"Citi Newsroom","url":"https://citinewsroom.com/2025/10/data-protection-commission-probes-handling-of-patient-data-managed-by-lightwave/","archiveUrl":"https://web.archive.org/web/20261005170925/https://citinewsroom.com/2025/10/data-protection-commission-probes-handling-of-patient-data-managed-by-lightwave/","theme":"other","status":"alleged","id":"GHA-S003","pageUrl":"https://healthrecordrights.com/real-cases/#GHA-S003","countryUrl":"https://healthrecordrights.com/brief/ghana/","why":"Regulators are checking who can reach millions of patient records and whether the law was followed.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GHA","country":"Ghana","date":"2025-10-30","headline":"Health minister says the state lacked control over citizens' electronic medical records","paraphrase":"The minister said a private vendor held exclusive access to patients' electronic records, refused state administrative control, and switched the system off, leaving it down for two weeks. The vendor publicly disputes his account.","source":"Graphic Online","url":"https://www.graphic.com.gh/news/general-news/ghana-news-health-minister-uncovers-100m-e-health-scandal-rolls-out-4-week-fix.html","archiveUrl":"https://web.archive.org/web/20261005170946/https://www.graphic.com.gh/news/general-news/ghana-news-health-minister-uncovers-100m-e-health-scandal-rolls-out-4-week-fix.html","theme":"other","status":"alleged","id":"GHA-S004","pageUrl":"https://healthrecordrights.com/real-cases/#GHA-S004","countryUrl":"https://healthrecordrights.com/brief/ghana/","why":"If the state cannot administer its own record system, patients' records can be switched off.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GHA","country":"Ghana","date":"2025-11-08","headline":"Doctors say years of patient records became unreachable when the system shut down","paraphrase":"A specialist told reporters that records back to 2020 were inaccessible after the national system shut down for weeks. Patients were asked to recall their own medicines, and staff logged new data in exercise books.","source":"MyJoyOnline (JoyNews)","url":"https://www.myjoyonline.com/e-health-records-disaster-clinicians-risk-misdiagnosing-patients-after-losing-5-years-of-medical-data/","archiveUrl":"https://web.archive.org/web/20261005171003/https://www.myjoyonline.com/e-health-records-disaster-clinicians-risk-misdiagnosing-patients-after-losing-5-years-of-medical-data/","theme":"other","status":"alleged","id":"GHA-S005","pageUrl":"https://healthrecordrights.com/real-cases/#GHA-S005","countryUrl":"https://healthrecordrights.com/brief/ghana/","why":"Without past results and prescriptions, doctors must rely on what patients remember.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GRC","country":"Greece","date":"2026-05-07","headline":"Public hospital left its surgery waiting list, with patients' phone numbers, open online","paraphrase":"A member of the public found, through a search engine, a hospital file listing about 2,820 patients' phone numbers and planned operations, online for months. The hospital reported late, never told patients, and was fined 25,000 euros.","source":"Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ΑΠΔΠΧ), decision 13/2026","url":"https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-se-nosokomeio-gia-mi-tirisi-tehnikon-kai-organotikon","theme":"breach","status":"finding","id":"GRC-S001","pageUrl":"https://healthrecordrights.com/real-cases/#GRC-S001","countryUrl":"https://healthrecordrights.com/brief/greece/","why":"A routine upload can expose thousands of patients for months, and nobody tells them.","sourceType":"regulator_decision","lang":"el","providerName":"Γενικό Νοσοκομείο Θεσσαλονίκης Γ. Γεννηματάς «Ο Άγιος Δημήτριος»","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"GRC","country":"Greece","date":"2025-04-09","headline":"Private doctor looked up a patient's national health record without permission","paraphrase":"A patient asked a private doctor for her full file and complained the doctor had also searched her electronic health record. The regulator found the lookup unlawful, done without her knowledge, and fined the doctor 5,000 euros.","source":"Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ΑΠΔΠΧ), decision 11/2025","url":"https://www.dpa.gr/el/enimerwtiko/prakseisArxis/exetasi-kataggelias-gia-mi-pliri-ikanopoiisi-dikaiomatos-prosbasis","archiveUrl":"https://web.archive.org/web/20261005171328/https://www.dpa.gr/el/enimerwtiko/prakseisArxis/exetasi-kataggelias-gia-mi-pliri-ikanopoiisi-dikaiomatos-prosbasis","theme":"breach","status":"finding","id":"GRC-S002","pageUrl":"https://healthrecordrights.com/real-cases/#GRC-S002","countryUrl":"https://healthrecordrights.com/brief/greece/","why":"Anyone holding a patient's ID number can open the national record, and the patient may never know.","sourceType":"regulator_decision","lang":"el","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GRC","country":"Greece","date":"2024-12-18","headline":"Doctor kept patient's clinical photos online after she withdrew her consent","paraphrase":"A patient complained that her doctor posted photos taken during her care on his social media page. The regulator ruled that keeping them up after she withdrew consent was unlawful and ordered his consent forms rewritten.","source":"Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ΑΠΔΠΧ), decision 50/2024","url":"https://www.dpa.gr/el/enimerwtiko/prakseisArxis/exetasi-kataggelias-asthenoys-gia-parabiasi-dikaiomaton-ek-meroys-iatroy","archiveUrl":"https://web.archive.org/web/20261005171350/https://www.dpa.gr/el/enimerwtiko/prakseisArxis/exetasi-kataggelias-asthenoys-gia-parabiasi-dikaiomaton-ek-meroys-iatroy","theme":"sold_or_shared","status":"finding","id":"GRC-S003","pageUrl":"https://healthrecordrights.com/real-cases/#GRC-S003","countryUrl":"https://healthrecordrights.com/brief/greece/","why":"Patient photos are part of the record; withdrawing consent should end their public use.","sourceType":"regulator_decision","lang":"el","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GRC","country":"Greece","date":"2024-10-11","headline":"Hospital doctor running for parliament texted campaign messages to former patients","paraphrase":"People who had been treated at a public hospital received election text messages from a doctor there who was a candidate. He could not show how he got their numbers; the regulator fined him 15,000 euros.","source":"Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ΑΠΔΠΧ), decision 37/2024","url":"https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-se-ypopsifio-boyleyti-iatro-dimosioy-nosokomeioy-gia","archiveUrl":"https://web.archive.org/web/20261005171420/https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-se-ypopsifio-boyleyti-iatro-dimosioy-nosokomeioy-gia","theme":"sold_or_shared","status":"finding","id":"GRC-S004","pageUrl":"https://healthrecordrights.com/real-cases/#GRC-S004","countryUrl":"https://healthrecordrights.com/brief/greece/","why":"Contact details given for care were reused for politics, without patients knowing or agreeing.","sourceType":"regulator_decision","lang":"el","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GRC","country":"Greece","date":"2025-02-01","headline":"Hospital said it could not supply copies of past scans after a cyberattack","paraphrase":"A relative asked a university hospital for copies of a patient's earlier test results. The hospital replied it had no access to its electronic system because of a cyberattack; the outlet reports other patients got the same answer.","source":"in.gr","url":"https://www.in.gr/2025/02/01/health/nosokomeio-axepa-anapantita-erotimata-gia-endexomeni-diarroi-eyaisthiton-prosopikon-dedomenon-asthenon/","archiveUrl":"https://web.archive.org/web/20261005171520/https://www.in.gr/2025/02/01/health/nosokomeio-axepa-anapantita-erotimata-gia-endexomeni-diarroi-eyaisthiton-prosopikon-dedomenon-asthenon/","theme":"access_refused","status":"alleged","id":"GRC-S005","pageUrl":"https://healthrecordrights.com/real-cases/#GRC-S005","countryUrl":"https://healthrecordrights.com/brief/greece/","why":"When a hospital system goes down, patients can lose access to their own history with no timeline.","sourceType":"journalism","lang":"el","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GRL","country":"Greenland","date":"2026-07-29","headline":"National patient record outage stops bookings and prescription renewals across Greenland","paraphrase":"The health service said its electronic patient record was down. While it lasted, patients could not book consultations, make appointments or have prescriptions renewed, and the service said it was working on a fix.","source":"Sermitsiaq","url":"https://www.sermitsiaq.ag/samfund/sundhedsvaesenet-oplever-nedbrud/2410211","theme":"access_delay_or_cost","status":"admitted","id":"GRL-S001","pageUrl":"https://healthrecordrights.com/real-cases/#GRL-S001","countryUrl":"https://healthrecordrights.com/brief/greenland/","why":"With one national record system, a single failure stops patients everywhere from booking care or renewing prescriptions.","sourceType":"journalism","lang":"da","providerName":"Det Grønlandske Sundhedsvæsen (Kalaallit Nunaanni Peqqinnissaqarfik)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"GRL","country":"Greenland","date":"2026-02-03","headline":"Compensation decisions delayed while officials travel the country searching for old patient records","paraphrase":"Decisions in a government compensation scheme for care given without consent were postponed. The responsible minister said officials must travel around the country to find records, and that records were not always correctly kept.","source":"KNR","url":"https://knr.gl/da/nyheder/flere-kvinder-end-forventet-har-soegt-om-godtgoerelse-ufrivillig-praevention-i-nyere-tid","archiveUrl":"https://web.archive.org/web/20261005171608/https://knr.gl/da/nyheder/flere-kvinder-end-forventet-har-soegt-om-godtgoerelse-ufrivillig-praevention-i-nyere-tid","theme":"record_wrong","status":"admitted","id":"GRL-S002","pageUrl":"https://healthrecordrights.com/real-cases/#GRL-S002","countryUrl":"https://healthrecordrights.com/brief/greenland/","why":"When records are scattered or badly kept, people seeking redress wait longer and cannot rely on the record.","sourceType":"journalism","lang":"da","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GTM","country":"Guatemala","date":"2026-09-03","headline":"Ransomware locked a national hospital's clinical planning records, delaying sessions for 194 patients","paraphrase":"Attackers encrypted the system holding a national specialist hospital's clinical plans and images and demanded payment. The hospital's leadership said it refused to negotiate, reported the attack to prosecutors and police, and rescheduled 194 patients.","source":"Infobae","url":"https://www.infobae.com/guatemala/2026/09/04/ataque-cibernetico-golpea-al-instituto-contra-el-cancer-en-guatemala-194-pacientes-datos-clinicos-encriptados-y-un-enlace-en-la-deep-web-para-negociar/","archiveUrl":"https://web.archive.org/web/20261005171631/https://www.infobae.com/guatemala/2026/09/04/ataque-cibernetico-golpea-al-instituto-contra-el-cancer-en-guatemala-194-pacientes-datos-clinicos-encriptados-y-un-enlace-en-la-deep-web-para-negociar/","theme":"breach","status":"admitted","id":"GTM-S001","pageUrl":"https://healthrecordrights.com/real-cases/#GTM-S001","countryUrl":"https://healthrecordrights.com/brief/guatemala/","why":"When attackers encrypt clinical records, patients lose care until the hospital can trust its data again.","sourceType":"journalism","lang":"es","providerName":"Instituto Nacional de Cancerología (INCAN), Liga Nacional Contra el Cáncer de Guatemala","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GTM","country":"Guatemala","date":"2026-04-13","headline":"Health ministry confirms attack encrypted files at its national laboratory","paraphrase":"The health ministry confirmed an attack that encrypted internal files at its national laboratory. It said backups restored the files and it found no evidence that patient data was accessed, but some processes and its web platform were interrupted.","source":"Prensa Libre","url":"https://www.prensalibre.com/guatemala/comunitario/ataque-informatico-afecta-al-laboratorio-nacional-de-salud-y-activa-protocolos-de-seguridad-breaking/","theme":"breach","status":"admitted","id":"GTM-S002","pageUrl":"https://healthrecordrights.com/real-cases/#GTM-S002","countryUrl":"https://healthrecordrights.com/brief/guatemala/","why":"Public health systems hold lab results for millions; even contained attacks interrupt services patients rely on.","sourceType":"journalism","lang":"es","providerName":"Ministerio de Salud Pública y Asistencia Social (Laboratorio Nacional de Salud)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"GIN","country":"Guinea","date":"2026-05-07","headline":"Clinic abroad withheld a patient's medical file until an extra fee was paid","paraphrase":"A patient treated at a clinic abroad was refused the medical file and follow-up paperwork until a further fee was paid, the outlet reports. The file was released once the bill was settled.","source":"Guinéenews","url":"https://guineenews.org/2026/05/07/evacuation-gaoussou-diaby-le-dossier-medical-debloque/","archiveUrl":"https://web.archive.org/web/20261005171137/https://guineenews.org/2026/05/07/evacuation-gaoussou-diaby-le-dossier-medical-debloque/","theme":"access_delay_or_cost","status":"alleged","id":"GIN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#GIN-S001","countryUrl":"https://healthrecordrights.com/brief/guinea/","why":"Patients sent abroad can be left without their own file, and the paperwork needed to continue care, until they pay more.","sourceType":"journalism","lang":"fr","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GUY","country":"Guyana","date":"2025-09-11","headline":"Public hospital apologises after staff member films patient and video spreads online","paraphrase":"A video of an adult patient filmed inside the hospital without permission circulated online. The hospital said a technician was the suspect, called it a violation of patient privacy, apologised, and referred the matter to police.","source":"iNews Guyana","url":"https://inewsguyana.com/police-to-probe-gphc-staff-over-unauthorised-video-of-patient-receiving-emergency-care/","archiveUrl":"https://web.archive.org/web/20261005171746/https://inewsguyana.com/police-to-probe-gphc-staff-over-unauthorised-video-of-patient-receiving-emergency-care/","theme":"breach","status":"admitted","id":"GUY-S001","pageUrl":"https://healthrecordrights.com/real-cases/#GUY-S001","countryUrl":"https://healthrecordrights.com/brief/guyana/","why":"Shows that a patient's privacy inside a hospital can be broken by staff, and that the hospital treated it as a breach.","sourceType":"journalism","lang":"en","providerName":"Georgetown Public Hospital Corporation","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"HTI","country":"Haiti","date":"2026-07","headline":"Patient says a health worker disclosed confidential information from her file","paraphrase":"The paper reports that a woman says a health worker disclosed confidential health information about her, and it spread among people around her. A doctor quoted in the piece says confidentiality breaches happen.","source":"Le Nouvelliste","url":"https://lenouvelliste.com/article/269367/vih-en-haiti-quand-la-discrimination-sajoute-a-la-maladie-dans-les-hopitaux","archiveUrl":"https://web.archive.org/web/20261005172026/https://lenouvelliste.com/article/269367/vih-en-haiti-quand-la-discrimination-sajoute-a-la-maladie-dans-les-hopitaux","theme":"sold_or_shared","status":"alleged","id":"HTI-S001","pageUrl":"https://healthrecordrights.com/real-cases/#HTI-S001","countryUrl":"https://healthrecordrights.com/brief/haiti/","why":"When staff share what is in a patient's file, the patient bears stigma that no apology can undo.","sourceType":"journalism","lang":"fr","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"HTI","country":"Haiti","date":"2026-04-19","headline":"Gangs burn decades of patient archives at a public hospital, forcing care to restart","paraphrase":"The outlet reports that armed groups vandalised and burned nearly fifty years of archives at a public specialist hospital. A doctor there says he has had to restart some patients' follow-up from zero.","source":"AyiboPost","url":"https://ayibopost.com/50-ans-darchives-sur-la-sante-mentale-en-haiti-incendiees-par-des-gangs-a-mars-kline/","archiveUrl":"https://web.archive.org/web/20261005172044/https://ayibopost.com/50-ans-darchives-sur-la-sante-mentale-en-haiti-incendiees-par-des-gangs-a-mars-kline/","theme":"other","status":"alleged","id":"HTI-S002","pageUrl":"https://healthrecordrights.com/real-cases/#HTI-S002","countryUrl":"https://healthrecordrights.com/brief/haiti/","why":"When paper files are the only copy, an attack on a building erases patients' histories for good.","sourceType":"journalism","lang":"fr","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"HND","country":"Honduras","date":"2025-01-26","headline":"Social security server failure leaves doctors unable to open patients' records","paraphrase":"A patient arrived for a booked consultation and was sent away because staff could not open her medical history. The institute's board said 14 of 24 storage disks failed, forcing staff to record visits by hand for weeks.","source":"La Prensa (Honduras)","url":"https://www.laprensa.hn/honduras/medicos-ihss-acceso-datos-pacientes-falla-servidores-IO23783092","theme":"access_refused","status":"admitted","id":"HND-S001","pageUrl":"https://healthrecordrights.com/real-cases/#HND-S001","countryUrl":"https://healthrecordrights.com/brief/honduras/","why":"When the only copy a clinic can reach goes dark, patients are turned away and care falls back to paper notes.","sourceType":"journalism","lang":"es","providerName":"Instituto Hondureño de Seguridad Social (IHSS)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"HND","country":"Honduras","date":"2025-10-06","headline":"Repeated system outages halt appointments and laboratory results for insured patients","paraphrase":"Insured patients were told there was no system for several days, so appointments, medicine and laboratory results stopped. The hospital director said the system had failed, as many times before, because of an internet provider problem.","source":"El Heraldo","url":"https://www.elheraldo.hn/honduras/fallas-sistema-afiliados-ihss-sin-citas-sin-recibir-medicamento-DB27626665","archiveUrl":"https://web.archive.org/web/20261005171828/https://www.elheraldo.hn/honduras/fallas-sistema-afiliados-ihss-sin-citas-sin-recibir-medicamento-DB27626665","theme":"access_delay_or_cost","status":"admitted","id":"HND-S002","pageUrl":"https://healthrecordrights.com/real-cases/#HND-S002","countryUrl":"https://healthrecordrights.com/brief/honduras/","why":"Results held only in a system that keeps failing reach patients late, or not at all.","sourceType":"journalism","lang":"es","providerName":"Instituto Hondureño de Seguridad Social (IHSS)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"HUN","country":"Hungary","date":"2026-03-20","headline":"Former family doctor opened an ex-patient's national health record 47 times","paraphrase":"A patient checked the access log in the national health record system and found a doctor they had left kept viewing their results and prescriptions for 19 months. The doctor also ignored their access request. The regulator imposed a fine.","source":"Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), decision NAIH-273-7/2026","url":"https://www.naih.hu/hatarozatok-vegzesek?download=1450%3Ajogalap-nelkuli-hozzaferes-az-eeszt-rendszerehez-es-hozzaferesi-kerelem-nemteljesitese","theme":"breach","status":"finding","id":"HUN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#HUN-S001","countryUrl":"https://healthrecordrights.com/brief/hungary/","why":"The national record's access log let a patient see who looked; the regulator fined the practice and ordered an answer.","sourceType":"regulator_decision","lang":"hu","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"HUN","country":"Hungary","date":"2026-03","headline":"Clinic charged per page for a patient's records, regulator rules access is free","paraphrase":"A patient asked a health institution to email all their outpatient records. It demanded a per-page fee and said records could only be collected in person. It sent them free months later, after the regulator opened a case.","source":"Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), annual report on 2025, case NAIH-2306-1/2025","url":"https://www.naih.hu/eves-beszamolok?download=1431:naih-beszamolo-a-2025-evi-tevekenysegrol","theme":"access_delay_or_cost","status":"finding","id":"HUN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#HUN-S002","countryUrl":"https://healthrecordrights.com/brief/hungary/","why":"Providers still treat the first free copy as already used up, putting a price on a patient's own data.","sourceType":"regulator_decision","lang":"hu","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"HUN","country":"Hungary","date":"2026-03","headline":"Stranger's visit record filed in a patient's national health record by name mix-up","paraphrase":"A health institution uploaded another person's outpatient visit sheet into a patient's national record because they shared a name. The regulator found the record inaccurate and faulted the institution for not reporting the resulting breach.","source":"Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), annual report on 2025, case NAIH-9859/2025","url":"https://www.naih.hu/eves-beszamolok?download=1431:naih-beszamolo-a-2025-evi-tevekenysegrol","theme":"record_wrong","status":"finding","id":"HUN-S003","pageUrl":"https://healthrecordrights.com/real-cases/#HUN-S003","countryUrl":"https://healthrecordrights.com/brief/hungary/","why":"One filing error makes two records wrong: one patient's file is inaccurate and another's data is exposed.","sourceType":"regulator_decision","lang":"hu","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"HUN","country":"Hungary","date":"2025-03","headline":"Patient files left in a closed health building after repeated break-ins","paraphrase":"A health institution left large volumes of patient records in a closed building that intruders kept entering, scattering files inside. It did not remove them or tell patients for over nine months. The regulator fined it two million forints.","source":"Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), annual report on 2024, case NAIH-295/2024","url":"https://www.naih.hu/eves-beszamolok?download=1167:naih-beszamolo-a-2024-evi-tevekenysegrol","theme":"breach","status":"finding","id":"HUN-S004","pageUrl":"https://healthrecordrights.com/real-cases/#HUN-S004","countryUrl":"https://healthrecordrights.com/brief/hungary/","why":"Paper records abandoned when a site closes can be read by anyone, and patients may never be told.","sourceType":"regulator_decision","lang":"hu","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"HUN","country":"Hungary","date":"2025-04-10","headline":"Ransomware group claims it stole a private clinic's patient files","paraphrase":"A ransomware group said it took about 178,000 files from a private clinic, including invoices and treatment reports, and threatened to publish them. The clinic had not answered press questions when the report appeared.","source":"Pénzcentrum (citing Telex)","url":"https://www.penzcentrum.hu/egeszseg/20250410/dobbenetes-hekkertamadas-erhette-a-sasszemklinikat-ez-mar-tenyleg-a-legalja-1177280","archiveUrl":"https://web.archive.org/web/20261005172403/https://www.penzcentrum.hu/egeszseg/20250410/dobbenetes-hekkertamadas-erhette-a-sasszemklinikat-ez-mar-tenyleg-a-legalja-1177280","theme":"breach","status":"alleged","id":"HUN-S005","pageUrl":"https://healthrecordrights.com/real-cases/#HUN-S005","countryUrl":"https://healthrecordrights.com/brief/hungary/","why":"Treatment reports and invoices posted by criminals cannot be pulled back, and patients may not be told.","sourceType":"journalism","lang":"hu","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ISL","country":"Iceland","date":"2026-05-12","headline":"Specialist doctor's repeated look-ups in a patient's record ruled unlawful","paraphrase":"A specialist doctor opened an adult's health record six times over several years without a treatment relationship or consent. The data protection authority ruled those look-ups unlawful but imposed no fine.","source":"Persónuvernd (Icelandic Data Protection Authority)","url":"https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/uppflettingar-landspitala-og-serfraedilaeknis-i-sjukraskra","theme":"breach","status":"finding","id":"ISL-S001","pageUrl":"https://healthrecordrights.com/real-cases/#ISL-S001","countryUrl":"https://healthrecordrights.com/brief/iceland/","why":"People close to a patient can sit inside the record system; only the access log shows who looked.","sourceType":"regulator_decision","lang":"is","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ISL","country":"Iceland","date":"2025-11-17","headline":"National hospital sent a patient's health data to the wrong primary care clinic","paraphrase":"The national hospital sent an adult patient's sensitive health information to a primary care clinic she was not registered with. The data protection authority ruled the disclosure unlawful; the hospital said it regretted the mistake.","source":"Persónuvernd (Icelandic Data Protection Authority)","url":"https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/uppflettingar-laeknis-i-sjukraskra-og-midlun-landspitalans-a-vidkvaemum-personuupplysingum-17-11-2025","theme":"sold_or_shared","status":"finding","id":"ISL-S002","pageUrl":"https://healthrecordrights.com/real-cases/#ISL-S002","countryUrl":"https://healthrecordrights.com/brief/iceland/","why":"Records sent to the wrong clinic put sensitive details in front of strangers and away from the patient's own doctor.","sourceType":"regulator_decision","lang":"is","providerName":"Landspítali","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ISL","country":"Iceland","date":"2025-11-03","headline":"Hospital employee's look-ups in a patient's record ruled unlawful","paraphrase":"A hospital employee opened an adult patient's health record twice with no work reason. The data protection authority held the employee personally responsible and ruled the look-ups unlawful.","source":"Persónuvernd (Icelandic Data Protection Authority)","url":"https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/oheimilar-uppflettingar-starfsmanns-landspitala-i-sjukraskra-3-11-2025","archiveUrl":"https://web.archive.org/web/20261005195234/https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/oheimilar-uppflettingar-starfsmanns-landspitala-i-sjukraskra-3-11-2025","theme":"breach","status":"finding","id":"ISL-S003","pageUrl":"https://healthrecordrights.com/real-cases/#ISL-S003","countryUrl":"https://healthrecordrights.com/brief/iceland/","why":"Staff with system access can open records with no care reason; patients learn of it only by asking for the log.","sourceType":"regulator_decision","lang":"is","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ISL","country":"Iceland","date":"2025-06-11","headline":"Court upholds fine over patient portal flaw that exposed other people's health files","paraphrase":"A district court confirmed the data protection authority's finding that the national patient portal had a serious security weakness letting users open others' health files and messages. It cut the fine on the Directorate of Health to ISK 8 million.","source":"Persónuvernd (Icelandic Data Protection Authority), on Reykjavík District Court case E-2571/2024","url":"https://island.is/en/news/akvoerdun-personuverndar-um-oeryggisveikleika-i-heilsuveru-stadfest-i","archiveUrl":"https://web.archive.org/web/20261005195259/https://island.is/en/news/akvoerdun-personuverndar-um-oeryggisveikleika-i-heilsuveru-stadfest-i","theme":"breach","status":"finding","id":"ISL-S004","pageUrl":"https://healthrecordrights.com/real-cases/#ISL-S004","countryUrl":"https://healthrecordrights.com/brief/iceland/","why":"A national patient portal let users reach other people's files for years by editing a web address.","sourceType":"court_judgment","lang":"en","providerName":"Directorate of Health (Embætti landlæknis)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ISL","country":"Iceland","date":"2025-12-29","headline":"Patient alleges doctors falsified record entries as complaint waits over three years","paraphrase":"A patient told the parliamentary ombudsman that two doctors entered false information in their health record and that access requests were mishandled. A complaint to the Directorate of Health had been pending for more than three years.","source":"DV","url":"https://www.dv.is/frettir/2025/12/29/laeknar-sakadir-um-ad-falsa-sjukraskyrslu-til-rannsoknar-hja-landlaekni-thrju-ar/","theme":"record_wrong","status":"alleged","id":"ISL-S005","pageUrl":"https://healthrecordrights.com/real-cases/#ISL-S005","countryUrl":"https://healthrecordrights.com/brief/iceland/","why":"When a patient disputes what a record says, a complaint can sit unresolved for years while the entries stand.","sourceType":"journalism","lang":"is","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ISL","country":"Iceland","date":"2026-06-15","headline":"Ombudsman leaves in place refusal of widow's access to late husband's health record","paraphrase":"A widow was refused access to her late husband's health record by a health institution, and the Directorate of Health upheld the refusal. The Parliamentary Ombudsman found no grounds to object, noting the request was not supported by documents.","source":"Umboðsmaður Alþingis, mál nr. 185/2026","url":"https://www.umbodsmadur.is/alit-og-bref/mal/nr/11384/skoda/mal","theme":"access_refused","status":"finding","id":"ISL-S006","pageUrl":"https://healthrecordrights.com/real-cases/#ISL-S006","countryUrl":"https://healthrecordrights.com/brief/iceland/","why":"Shows how hard it is for close relatives to get a deceased person's record without documenting strong reasons.","sourceType":"regulator_decision","lang":"is","lastVerified":"2026-10-07","addedOn":"2026-10-07","inLanguage":"en"},{"iso3":"IND","country":"India","date":"2024-10-11","headline":"Health insurer confirms illegal access to customer records offered through chatbots","paraphrase":"Records of more than 30 million customers, including ID images and claim documents, were offered through chatbots and later a website. The insurer acknowledged unauthorized and illegal access to certain data and obtained a court injunction.","source":"The Register","url":"https://www.theregister.com/2024/10/11/star_health_breach/","theme":"breach","status":"admitted","id":"IND-S001","pageUrl":"https://healthrecordrights.com/real-cases/#IND-S001","countryUrl":"https://healthrecordrights.com/brief/india/","why":"Insurers hold claim files full of medical detail; one breach can expose tens of millions of policyholders at once.","sourceType":"journalism","lang":"en","providerName":"Star Health","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"IND","country":"India","date":"2025-12-20","headline":"Consumer commission orders hospital to hand over a senior citizen's discharge papers","paraphrase":"A private hospital did not give a retired patient the discharge summary, case papers and receipts, so the insurance claim could not be filed. A district consumer commission ordered compensation and the papers supplied within one month.","source":"Medical Dialogues","url":"https://medicaldialogues.in/news/health/medico-legal/consumer-court-slaps-rs-60k-compensation-on-hospital-for-withholding-discharge-summary-from-covid-patient-161066","theme":"access_refused","status":"finding","id":"IND-S002","pageUrl":"https://healthrecordrights.com/real-cases/#IND-S002","countryUrl":"https://healthrecordrights.com/brief/india/","why":"Without discharge papers a patient cannot claim insurance; the commission treated withholding them as deficient service.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"IND","country":"India","date":"2026-08-03","headline":"Hospital group tells police patient records were posted online without authorization","paraphrase":"A hospital group's chief executive told police that patients' personal details and medical records, with staff data and internal documents, were posted on an outside website. The state cyber bureau registered a case and is investigating.","source":"NewsMeter","url":"https://newsmeter.in/hyderabad/healthcare-data-breach-tgcsb-registers-case-after-star-hospitals-patients-records-leaked-online-772895","theme":"breach","status":"alleged","id":"IND-S003","pageUrl":"https://healthrecordrights.com/real-cases/#IND-S003","countryUrl":"https://healthrecordrights.com/brief/india/","why":"Patients learn of a leak only when the hospital or police speak; here the hospital itself went to the police.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"IND","country":"India","date":"2025-04-07","headline":"Researchers say a hospital chain left patient records and ID documents exposed online","paraphrase":"Security researchers reported finding a file on a subsidiary website holding patient records, vaccination reports and identity documents. They told national cyber agencies; more than 60 days later the report saw no meaningful response and the chain had not replied.","source":"Decode (BOOM)","url":"https://www.decodeinternet.in/decode/hackers-may-have-stolen-patient-data-from-indias-largest-hospital-chain-28228","archiveUrl":"https://web.archive.org/web/20261005172723/https://www.decodeinternet.in/decode/hackers-may-have-stolen-patient-data-from-indias-largest-hospital-chain-28228","theme":"breach","status":"alleged","id":"IND-S004","pageUrl":"https://healthrecordrights.com/real-cases/#IND-S004","countryUrl":"https://healthrecordrights.com/brief/india/","why":"Patients are not told when researchers find their records exposed; the report says reports to agencies brought no visible action.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"IND","country":"India","date":"2026-04-10","headline":"Consumer commission orders hospitals to release a patient's complete records within 45 days","paraphrase":"Two linked hospitals did not give a patient's family the complete medical records despite repeated requests. A district consumer commission ordered the full records, including consent forms and procedure details, within 45 days, with interest if late.","source":"DT Next","url":"https://www.dtnext.in/amp/story/news/chennai/consumer-panel-holds-hospital-group-liable-for-negligence-awards-rs-7-lakh-compensation","archiveUrl":"https://web.archive.org/web/20261005172821/https://www.dtnext.in/amp/story/news/chennai/consumer-panel-holds-hospital-group-liable-for-negligence-awards-rs-7-lakh-compensation","theme":"access_refused","status":"finding","id":"IND-S005","pageUrl":"https://healthrecordrights.com/real-cases/#IND-S005","countryUrl":"https://healthrecordrights.com/brief/india/","why":"Patients often need their full file, including consent forms, to pursue a complaint; here a commission had to order it.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"IDN","country":"Indonesia","date":"2026-09-24","headline":"Patient's lawyer says a public hospital gave only partial copies of her records","paraphrase":"A woman asked a regional public hospital in Banten for copies of her medical records through her lawyer. The lawyer says only incomplete copies came, a legal notice went unanswered, and a Health Ministry complaint would follow.","source":"MediaBanten.com","url":"https://mediabanten.com/salinan-rekam-medis-tak-diberikan-rs-drajat-akan-dilaporkan-ke-kemenkes/","archiveUrl":"https://web.archive.org/web/20261005172437/https://mediabanten.com/salinan-rekam-medis-tak-diberikan-rs-drajat-akan-dilaporkan-ke-kemenkes/","theme":"access_refused","status":"alleged","id":"IDN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#IDN-S001","countryUrl":"https://healthrecordrights.com/brief/indonesia/","why":"Indonesian rules say the patient owns the content of the record; a lawyer still had to threaten complaints to obtain it.","sourceType":"journalism","lang":"id","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"IDN","country":"Indonesia","date":"2026-09-26","headline":"Patient says referral records sent to a hospital abroad were incomplete","paraphrase":"A patient in East Kalimantan alleges that the records a public hospital sent with his referral abroad were incomplete, including a video of his care cut at crucial moments, and that the referral letter misstated his state of health.","source":"Swarakaltim.com","url":"https://swarakaltim.com/2026/09/26/diduga-alami-malapraktik-kawat-tertinggal-di-jantung-pasien-rsud-aws-layangkan-somasi-dan-tuntut-kompensasi-rp5-miliar/","archiveUrl":"https://web.archive.org/web/20261005172528/https://swarakaltim.com/2026/09/26/diduga-alami-malapraktik-kawat-tertinggal-di-jantung-pasien-rsud-aws-layangkan-somasi-dan-tuntut-kompensasi-rp5-miliar/","theme":"lost_between_providers","status":"alleged","id":"IDN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#IDN-S002","countryUrl":"https://healthrecordrights.com/brief/indonesia/","why":"When a record moves between hospitals, gaps leave the next doctor without what happened; the patient bears the cost.","sourceType":"journalism","lang":"id","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"IRN","country":"Iran","date":"2024-10-23","headline":"Health ministry has 333 clinic social pages blocked for posting patient images","paraphrase":"Doctors and clinics posted patients' photos, videos and record details on social media pages. The health ministry referred 333 pages to prosecutors, who blocked them, and cases went to courts and the medical council.","source":"Kayhan","url":"https://kayhan.ir/fa/news/298197/","archiveUrl":"https://web.archive.org/web/20261005173024/https://kayhan.ir/fa/news/298197/","theme":"sold_or_shared","status":"finding","id":"IRN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#IRN-S001","countryUrl":"https://healthrecordrights.com/brief/iran/","why":"Patients' images and record details were published by the people trusted to keep them confidential.","sourceType":"journalism","lang":"fa","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"IRN","country":"Iran","date":"2026-02-15","headline":"Security council sought medical records of people hurt in protests, lawmaker says","paraphrase":"A member of parliament's health committee confirmed a security council letter asking medical universities for patients' records after the January protests. He said the health ministry objected in confidential correspondence, citing patient confidentiality.","source":"Khabar Online","url":"https://www.khabaronline.ir/news/2182585/","archiveUrl":"https://web.archive.org/web/20261005173048/https://www.khabaronline.ir/news/2182585/","theme":"sold_or_shared","status":"alleged","id":"IRN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#IRN-S002","countryUrl":"https://healthrecordrights.com/brief/iran/","why":"Patients may avoid care if hospital records can be handed to security bodies without legal process.","sourceType":"journalism","lang":"fa","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"IRN","country":"Iran","date":"2026-02-02","headline":"Reports say security forces searched hospital files to identify treated protesters","paraphrase":"Reports cited by the outlet say security officers checked hospital records of discharged patients and pressed medical staff to report certain patients, and many people avoided hospitals for fear of arrest.","source":"Radio Zamaneh","url":"https://www.radiozamaneh.com/876871/","theme":"sold_or_shared","status":"alleged","id":"IRN-S003","pageUrl":"https://healthrecordrights.com/real-cases/#IRN-S003","countryUrl":"https://healthrecordrights.com/brief/iran/","why":"When records become a tool for identification, people stop seeking care and stop trusting hospitals with their data.","sourceType":"journalism","lang":"fa","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"IRN","country":"Iran","date":"2026-01-12","headline":"E-prescription records show medicines dispensed in full when patients got only part","paraphrase":"Pharmacists say drugs dropped from a prescription are often not recorded, so the national e-prescription system shows a complete prescription while the patient received only part of it.","source":"Asr Iran","url":"https://www.asriran.com/fa/news/1131759/","archiveUrl":"https://web.archive.org/web/20261005195019/https://www.asriran.com/fa/news/1131759/","theme":"record_wrong","status":"alleged","id":"IRN-S004","pageUrl":"https://healthrecordrights.com/real-cases/#IRN-S004","countryUrl":"https://healthrecordrights.com/brief/iran/","why":"A medication record listing drugs never received misleads later care and official statistics.","sourceType":"journalism","lang":"fa","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"IRQ","country":"Iraq","date":"2026-08-04","headline":"Investigation reports trainees filming procedures on phones, with a patient's name visible","paraphrase":"An investigation into teaching hospitals quoted a trainee who said students filmed a procedure on their phones and the patient's name appeared in the footage. No one told the patient. The health ministry did not reply.","source":"Al-Mada","url":"https://almadapaper.net/446748/","archiveUrl":"https://web.archive.org/web/20261005195051/https://almadapaper.net/446748/","theme":"breach","status":"alleged","id":"IRQ-S001","pageUrl":"https://healthrecordrights.com/real-cases/#IRQ-S001","countryUrl":"https://healthrecordrights.com/brief/iraq/","why":"Phone footage that shows a patient's name can spread beyond the hospital without the patient ever knowing.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"IRL","country":"Ireland","date":"2026-06-30","headline":"Patient's request to correct GP record went unanswered until the regulator asked","paraphrase":"A patient asked a former GP surgery to correct entries they believed were wrong and heard nothing. After the regulator stepped in, the surgery apologised, kept the entries as clinical opinion, and offered to add the patient's disagreement.","source":"Data Protection Commission (Annual Report 2025 case studies)","url":"https://www.dataprotection.ie/sites/default/files/uploads/2026-07/DPC-CaseStudies2025-Digital-AW.pdf","theme":"access_delay_or_cost","status":"finding","id":"IRL-S002","pageUrl":"https://healthrecordrights.com/real-cases/#IRL-S002","countryUrl":"https://healthrecordrights.com/brief/ireland/","why":"Shows the limit of correction rights: clinical opinions usually stay, but a patient can add their own statement.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-07","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"IRL","country":"Ireland","date":"2026-06-30","headline":"GP surgery emailed a patient's details unencrypted to the wrong person","paraphrase":"A small GP surgery recorded a mistyped email address without checking it, then sent the patient's personal data, unencrypted, from a free email account to a stranger. After the regulator engaged, it moved to secure email and a patient portal.","source":"Data Protection Commission (Annual Report 2025 case studies)","url":"https://www.dataprotection.ie/sites/default/files/uploads/2026-07/DPC-CaseStudies2025-Digital-AW.pdf","theme":"breach","status":"finding","id":"IRL-S003","pageUrl":"https://healthrecordrights.com/real-cases/#IRL-S003","countryUrl":"https://healthrecordrights.com/brief/ireland/","why":"Free, unencrypted email for patient letters means one typo can expose a record to a stranger.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-07","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"IRL","country":"Ireland","date":"2025-06","headline":"Hospital released a patient's records only after the regulator stepped in","paraphrase":"A patient asked a public hospital for all the personal data it held. More than a month later there was still no answer, though the matter was urgent. The records were provided only after the regulator contacted the hospital group.","source":"Data Protection Commission (Annual Report 2024 case studies)","url":"https://www.dataprotection.ie/sites/default/files/uploads/2025-08/DPC_Cases_Studies_EN_Low_Res.pdf","archiveUrl":"https://web.archive.org/web/20261005172904/https://www.dataprotection.ie/sites/default/files/uploads/2025-08/DPC_Cases_Studies_EN_Low_Res.pdf","theme":"access_delay_or_cost","status":"finding","id":"IRL-S004","pageUrl":"https://healthrecordrights.com/real-cases/#IRL-S004","countryUrl":"https://healthrecordrights.com/brief/ireland/","why":"A request for your own records should not need a regulator to get an answer.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"IRL","country":"Ireland","date":"2025-06","headline":"Medical facility sent a worker's full consultation notes to their employer","paraphrase":"A worker was sent by their employer to a medical facility. The facility gave the employer, including the HR department, full consultation notes with past medical history, assuming consent. The regulator found the disclosure unlawful.","source":"Data Protection Commission (Annual Report 2024 case studies)","url":"https://www.dataprotection.ie/sites/default/files/uploads/2025-08/DPC_Cases_Studies_EN_Low_Res.pdf","archiveUrl":"https://web.archive.org/web/20261005172904/https://www.dataprotection.ie/sites/default/files/uploads/2025-08/DPC_Cases_Studies_EN_Low_Res.pdf","theme":"sold_or_shared","status":"finding","id":"IRL-S005","pageUrl":"https://healthrecordrights.com/real-cases/#IRL-S005","countryUrl":"https://healthrecordrights.com/brief/ireland/","why":"An employer usually needs only fit or unfit for work, not a person's medical history.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"IRL","country":"Ireland","date":"2026-09-07","headline":"Regulator fines national health service after intruders reached poorly stored paper records","paraphrase":"Intruders reached paper patient records in disused health service storage and filmed them. The data protection regulator found records insecure and damaged, breaches reported late, and affected people not told, and imposed a fine.","source":"Cybernews","url":"https://cybernews.com/security/irish-hse-fined-eur645k-records-mold-and-rubble/","archiveUrl":"https://web.archive.org/web/20261005172939/https://cybernews.com/security/irish-hse-fined-eur645k-records-mold-and-rubble/","theme":"breach","status":"finding","id":"IRL-S006","pageUrl":"https://healthrecordrights.com/real-cases/#IRL-S006","countryUrl":"https://healthrecordrights.com/brief/ireland/","why":"Paper records left insecure can be seen by strangers, damaged, or unavailable for later care, and patients may never be told.","sourceType":"journalism","lang":"en","providerName":"Health Service Executive (HSE)","lastVerified":"2026-10-04","addedOn":"2026-10-04","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ISR","country":"Israel","date":"2026-07-21","headline":"Health fund fined for slow reporting of a fault exposing members' medical files","paraphrase":"A member reported he could open a relative's medical file because of a system fault. The regulator found the fund knew in November 2025 but reported only in January, and fined it 256,000 shekels. The fund plans to appeal.","source":"Calcalist (reporting a Privacy Protection Authority decision)","url":"https://www.calcalist.co.il/local_news/article/hjnnojpezl","theme":"breach","status":"finding","id":"ISR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#ISR-S001","countryUrl":"https://healthrecordrights.com/brief/israel/","why":"A system fault let members open relatives' records, and the fund took two months to tell the regulator.","sourceType":"journalism","lang":"he","providerName":"Meuhedet Health Fund (Kupat Holim Meuhedet)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ISR","country":"Israel","date":"2025-10-03","headline":"Health ministry confirms patients' medical information leaked in hospital cyberattack","paraphrase":"The health ministry said initial checks showed emails sent to and from the hospital on one day had leaked, including medical information in them. It said there was no sign so far of a leak from the central record system.","source":"Walla News","url":"https://news.walla.co.il/item/3784752","archiveUrl":"https://web.archive.org/web/20261005195515/https://news.walla.co.il/item/3784752","theme":"breach","status":"admitted","id":"ISR-S002","pageUrl":"https://healthrecordrights.com/real-cases/#ISR-S002","countryUrl":"https://healthrecordrights.com/brief/israel/","why":"Medical details sent by email can leak in an attack even when the main record system holds.","sourceType":"journalism","lang":"he","providerName":"Shamir (Assaf Harofeh) Medical Center","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ISR","country":"Israel","date":"2026-02-25","headline":"Hackers claim they published thousands of patient documents taken from a health fund","paraphrase":"A hacker group claimed to have stolen and posted documents of more than 10,000 patients, including referrals and sick-leave notes. The fund said it was checking the claim with national cyber authorities and had reported to the privacy regulator.","source":"Channel 14 (C14)","url":"https://www.c14.co.il/article/1472789","theme":"breach","status":"alleged","id":"ISR-S003","pageUrl":"https://healthrecordrights.com/real-cases/#ISR-S003","countryUrl":"https://healthrecordrights.com/brief/israel/","why":"Claims of stolen referrals and sick notes show how much a health fund holds about each member.","sourceType":"journalism","lang":"he","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ITA","country":"Italy","date":"2025-12-18","headline":"Clinic warned after sending a patient's test report to the wrong email address","paraphrase":"A patient learned his report had gone to an address one letter different from his, carrying his name, birth date and tax code. The regulator found no address check was in place and issued a formal warning.","source":"Garante per la protezione dei dati personali","url":"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10210247","archiveUrl":"https://web.archive.org/web/20261005195555/https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10210247","theme":"breach","status":"finding","id":"ITA-S002","pageUrl":"https://healthrecordrights.com/real-cases/#ITA-S002","countryUrl":"https://healthrecordrights.com/brief/italy/","why":"One mistyped letter put a patient's report and identity details in a stranger's inbox.","sourceType":"regulator_decision","lang":"it","providerName":"Studio Fisiokinesiterapico Romano s.r.l.","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ITA","country":"Italy","date":"2025-03-13","headline":"Private clinic warned after a patient's full medical file was lost in archiving","paraphrase":"A clinic could not produce a patient's medical file when investigators asked for it; the archive company said it never received the file. The regulator found the clinic failed to report the loss in time and issued a warning.","source":"Garante per la protezione dei dati personali","url":"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10132289","archiveUrl":"https://web.archive.org/web/20261005195620/https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10132289","theme":"other","status":"finding","id":"ITA-S003","pageUrl":"https://healthrecordrights.com/real-cases/#ITA-S003","countryUrl":"https://healthrecordrights.com/brief/italy/","why":"A record handed to an archive contractor vanished, and the loss was not reported to the regulator on time.","sourceType":"regulator_decision","lang":"it","providerName":"Casa di Cura Sant'Antonino s.r.l.","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ITA","country":"Italy","date":"2024-11-13","headline":"Hospital warned after hiding a report in a patient's e-record changed its date","paraphrase":"A patient said a hospital put a report in her electronic health record without telling her. When she asked for it to be hidden, the system created a replacement dated the day of the change. The regulator issued a warning.","source":"Garante per la protezione dei dati personali","url":"https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10087191","archiveUrl":"https://web.archive.org/web/20261005195640/https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10087191","theme":"record_wrong","status":"finding","id":"ITA-S004","pageUrl":"https://healthrecordrights.com/real-cases/#ITA-S004","countryUrl":"https://healthrecordrights.com/brief/italy/","why":"Patients can hide documents in their national e-record, but the process must not make the record inaccurate.","sourceType":"regulator_decision","lang":"it","providerName":"Ospedali privati di Forlì","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ITA","country":"Italy","date":"2025-12-31","headline":"Prescriptions of about 90,000 Lombardy patients offered for sale after software breach","paraphrase":"Data stolen in March from the company running a portal family doctors use to send prescriptions went on sale online: prescriptions, sick notes, exemption certificates, emails, phones and addresses. The company reported it to police and warned patients of phishing.","source":"Il Post","url":"https://www.ilpost.it/2025/12/31/dati-sanitari-90mila-pazienti-vendita-dark-web/","theme":"breach","status":"admitted","id":"ITA-S005","pageUrl":"https://healthrecordrights.com/real-cases/#ITA-S005","countryUrl":"https://healthrecordrights.com/brief/italy/","why":"A third-party app used by family doctors became the weak point for patients' prescriptions and contact details.","sourceType":"journalism","lang":"it","providerName":"Murex Software (Paziente Consapevole)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ITA","country":"Italy","date":"2026-10-03","headline":"Italian regulator fines analytics firm over GP patient records it wrongly called anonymous","paraphrase":"Italy's data protection authority found a health data company treated records of about one million GP patients as anonymous when they were personal, processing them without legal basis or patient notice; identifiers of 3,370 patients also slipped through.","source":"PPC Land","url":"https://ppc.land/italy-fines-iqvia-eur7m-over-health-data-of-1m-patients-it-called-anonymous/","archiveUrl":"https://web.archive.org/web/20261005195810/https://ppc.land/italy-fines-iqvia-eur7m-over-health-data-of-1m-patients-it-called-anonymous/","theme":"sold_or_shared","status":"finding","id":"ITA-S006","pageUrl":"https://healthrecordrights.com/real-cases/#ITA-S006","countryUrl":"https://healthrecordrights.com/brief/italy/","why":"Shows that health records called anonymous can still identify patients, and that sharing them needs a legal basis and notice.","sourceType":"journalism","lang":"en","providerName":"IQVIA Solutions Italy S.r.l.","lastVerified":"2026-10-04","addedOn":"2026-10-04","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"JAM","country":"Jamaica","date":"2026-06-10","headline":"Hackers claim to hold medication data on National Health Fund clients","paraphrase":"The National Health Fund confirmed a cyber incident after a hacker group said it held clients' medication data. The fund reported it to the Information Commissioner and police investigators and said affected stakeholders were contacted.","source":"The Gleaner","url":"https://jamaica-gleaner.com/article/news/20260610/tufton-hackers-claim-access-nhf-client-medical-data-moca-called","theme":"breach","status":"admitted","id":"JAM-S001","pageUrl":"https://healthrecordrights.com/real-cases/#JAM-S001","countryUrl":"https://healthrecordrights.com/brief/jamaica/","why":"A national drug-subsidy fund holds who takes which medicines; a leak exposes that to strangers.","sourceType":"journalism","lang":"en","providerName":"National Health Fund","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"JPN","country":"Japan","date":"2025-02-18","headline":"Clinic says ransomware attack may have exposed up to 300,000 people's records","paraphrase":"A clinic announced that ransomware hit its servers, possibly exposing about 300,000 patient and staff records, including contact details, medical history and checkup results. It paused new outpatient bookings and said it had consulted police.","source":"Nikkei xTECH","url":"https://xtech.nikkei.com/atcl/nxt/news/24/02182/","theme":"breach","status":"admitted","id":"JPN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#JPN-S001","countryUrl":"https://healthrecordrights.com/brief/japan/","why":"A single clinic server held names, contact details, medical history and checkup results for hundreds of thousands of people.","sourceType":"journalism","lang":"ja","providerName":"Utsunomiya Central Clinic","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"JPN","country":"Japan","date":"2026-02-16","headline":"Hospital confirms attackers stole patient details through a maintenance VPN","paraphrase":"A university hospital announced that a ransomware attack, entering through a VPN device used for medical equipment maintenance, led to the theft of names, addresses, birth dates and patient IDs of about 10,000 patients.","source":"INTERNET Watch (Impress)","url":"https://internet.watch.impress.co.jp/docs/news/2086066.html","theme":"breach","status":"admitted","id":"JPN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#JPN-S002","countryUrl":"https://healthrecordrights.com/brief/japan/","why":"Remote links left open for equipment vendors can become the way in to patients' records.","sourceType":"journalism","lang":"ja","providerName":"Nippon Medical School Musashi Kosugi Hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"JPN","country":"Japan","date":"2026-05-01","headline":"Hospital worker suspended for reading a person's record and telling others what it showed","paraphrase":"A public hospital's administrative support worker opened another person's electronic record several times with no work reason and told others what it showed. The prefectural hospital bureau suspended her for three months.","source":"Too Nippo (東奥日報)","url":"https://www.toonippo.co.jp/articles/-/2264492","theme":"breach","status":"admitted","id":"JPN-S003","pageUrl":"https://healthrecordrights.com/real-cases/#JPN-S003","countryUrl":"https://healthrecordrights.com/brief/japan/","why":"Staff with system access can read someone's record and pass it on; the patient learns only if someone reports it.","sourceType":"journalism","lang":"ja","providerName":"Aomori Prefectural Central Hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"JPN","country":"Japan","date":"2026-06-08","headline":"Hospital hard drives meant for shredding turned up for sale at online auction","paraphrase":"Hard drives two public hospitals sent for destruction were listed on internet auctions, holding names, addresses, clinical notes and nursing records for up to 510,000 people. The disposal firm said destroyed and intact drives were kept in identical containers.","source":"Hokkaido Cultural Broadcasting (UHB)","url":"https://www.uhb.jp/news/single.html?id=59930","theme":"breach","status":"admitted","id":"JPN-S004","pageUrl":"https://healthrecordrights.com/real-cases/#JPN-S004","countryUrl":"https://healthrecordrights.com/brief/japan/","why":"Records do not die when a hospital retires its computers; disposal contractors can let them back out.","sourceType":"journalism","lang":"ja","providerName":"National Hospital Organization","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"JOR","country":"Jordan","date":"2026-06-24","headline":"Insurers warn unauthorised claims platforms are reaching into patients' medical data","paraphrase":"Health insurers and their industry union told insured people not to use a non-insurer claims platform, saying its access to patients' medical data breaks the personal data protection law and delays approvals for treatment.","source":"Roya News","url":"https://royanews.tv/news/386623","archiveUrl":"https://web.archive.org/web/20261005195844/https://royanews.tv/news/386623","theme":"sold_or_shared","status":"alleged","id":"JOR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#JOR-S001","countryUrl":"https://healthrecordrights.com/brief/jordan/","why":"Patients may not know which outside platforms can see their medical records when an insurance claim is filed.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"KAZ","country":"Kazakhstan","date":"2026-07-08","headline":"Clinic notice about an adult patient's care went to a family member's phone","paraphrase":"An adult patient says an automatic clinic notice about her care went to a family member. The health ministry said the clinic had likely never updated a relative's number added years earlier, and it is reviewing the SMS system.","source":"Tengrinews.kz","url":"https://tengrinews.kz/tengri-health/almatinka-zayavila-utechke-dannyih-preryivaniya-beremennosti-602773/","theme":"breach","status":"alleged","id":"KAZ-S003","pageUrl":"https://healthrecordrights.com/real-cases/#KAZ-S003","countryUrl":"https://healthrecordrights.com/brief/kazakhstan/","why":"Outdated contact details in a record can send private medical notices to family members.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"KAZ","country":"Kazakhstan","date":"2026-04-24","headline":"App users report strangers' test results and false records in their health accounts","paraphrase":"Users of the national health app reported seeing other people's test results in their accounts. One woman said a clinic told her she was recorded as dead and had been removed from its patient list.","source":"NewTimes.kz","url":"https://newtimes.kz/obshchestvo/218584-opasnyi-sboi-v-damumed-poiavliaiutsia-chuzhie-deti-i-analizy","archiveUrl":"https://web.archive.org/web/20261005200646/https://newtimes.kz/obshchestvo/218584-opasnyi-sboi-v-damumed-poiavliaiutsia-chuzhie-deti-i-analizy","theme":"record_wrong","status":"alleged","id":"KAZ-S004","pageUrl":"https://healthrecordrights.com/real-cases/#KAZ-S004","countryUrl":"https://healthrecordrights.com/brief/kazakhstan/","why":"When records are linked to the wrong person, private results leak and patients can lose access to care.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"KAZ","country":"Kazakhstan","date":"2025-07-15","headline":"Prime minister says leak of 16 million people's data likely came from medical organisations","paraphrase":"Personal data of about 16.3 million people appeared online. The prime minister said preliminary findings pointed to medical organisations that had access to state databases but failed to protect them. A criminal case was opened.","source":"Vlast.kz","url":"https://vlast.kz/novosti/65697-utecka-dannyh-bolee-16-mln-kazahstancev-mogla-proizojti-iz-medorganizacij-bektenov.html","archiveUrl":"https://web.archive.org/web/20261005200728/https://vlast.kz/novosti/65697-utecka-dannyh-bolee-16-mln-kazahstancev-mogla-proizojti-iz-medorganizacij-bektenov.html","theme":"breach","status":"alleged","id":"KAZ-S005","pageUrl":"https://healthrecordrights.com/real-cases/#KAZ-S005","countryUrl":"https://healthrecordrights.com/brief/kazakhstan/","why":"Clinics with access to state databases can expose whole populations when they fail to protect them.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"KEN","country":"Kenya","date":"2025-12-16","headline":"Regulator finds hospital had no way for patients to see or correct records","paraphrase":"An investigation the regulator opened itself found the hospital had no process for patients' access or correction requests, shared data with third parties without agreements, and was unregistered. An enforcement notice was issued.","source":"Office of the Data Protection Commissioner (Kenya)","url":"https://www.odpc.go.ke/wp-content/uploads/2026/01/ELDORET-HOSPITAL-2.pdf","archiveUrl":"https://web.archive.org/web/20261005200756/https://www.odpc.go.ke/wp-content/uploads/2026/01/ELDORET-HOSPITAL-2.pdf","theme":"other","status":"finding","id":"KEN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#KEN-S002","countryUrl":"https://healthrecordrights.com/brief/kenya/","why":"A legal right to see your record means little if the provider has no process to answer a request.","sourceType":"regulator_decision","lang":"en","providerName":"Eldoret Hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"KEN","country":"Kenya","date":"2024-12","headline":"Regulator finds weak access controls at a nursing home led to data breaches","paraphrase":"The regulator investigated on its own initiative and found no role-based checks on who received sensitive data, which led to several breaches, plus no process for access or correction requests. An enforcement notice followed.","source":"Office of the Data Protection Commissioner (Kenya)","url":"https://www.odpc.go.ke/wp-content/uploads/2025/01/20241218-SUO-MOTU-NALA-MATERNITY-NURSING-HOME-LIMITED.pdf","archiveUrl":"https://web.archive.org/web/20261005200826/https://www.odpc.go.ke/wp-content/uploads/2025/01/20241218-SUO-MOTU-NALA-MATERNITY-NURSING-HOME-LIMITED.pdf","theme":"breach","status":"finding","id":"KEN-S003","pageUrl":"https://healthrecordrights.com/real-cases/#KEN-S003","countryUrl":"https://healthrecordrights.com/brief/kenya/","why":"Without controls on who can see records, health data can be disclosed to the wrong people.","sourceType":"regulator_decision","lang":"en","providerName":"Nala Maternity and Nursing Home Limited","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"KEN","country":"Kenya","date":"2026-01-18","headline":"Hospital ordered to pay patient after using secretly filmed footage in its adverts","paraphrase":"The regulator found a staff member recorded a patient during treatment and the hospital showed the footage on its screens as promotion. It could not prove consent, so it must pay Sh500,000 and delete the adverts.","source":"Business Daily (reporting a Data Protection Commissioner decision)","url":"https://www.businessdailyafrica.com/bd/corporate/companies/nairobi-hospital-to-pay-patient-sh500000-illegal-use-of-images-5329802","theme":"sold_or_shared","status":"finding","id":"KEN-S005","pageUrl":"https://healthrecordrights.com/real-cases/#KEN-S005","countryUrl":"https://healthrecordrights.com/brief/kenya/","why":"Images taken during care are personal data and cannot be turned into marketing without clear consent.","sourceType":"journalism","lang":"en","providerName":"The Nairobi Hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"KEN","country":"Kenya","date":"2026-03-02","headline":"National health insurer apologises as system failure halts approvals at hospitals","paraphrase":"The insurer issued a notice that a critical failure at its digital platform since 1 March had stopped pre-authorisation and eligibility checks at contracted facilities nationwide. It apologised for the disruption to patient care.","source":"The Star (Kenya)","url":"https://www.the-star.co.ke/news/2026-03-02-health-services-hit-as-sha-platform-faces-outage","theme":"access_delay_or_cost","status":"admitted","id":"KEN-S006","pageUrl":"https://healthrecordrights.com/real-cases/#KEN-S006","countryUrl":"https://healthrecordrights.com/brief/kenya/","why":"When the digital system that verifies patients fails, care that needs approval can stall.","sourceType":"journalism","lang":"en","providerName":"Social Health Authority","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"KWT","country":"Kuwait","date":"2026-06-10","headline":"Appeals court fines a doctor for posting a patient's photo without consent","paraphrase":"A doctor published a patient's photograph, taken in connection with her care, on social media and advertising platforms without her consent. The Court of Appeals found this disclosed confidential medical information and imposed a fine.","source":"Arab Times (Kuwait), citing Al-Seyassah","url":"https://www.arabtimesonline.com/news/doctor-penalized-for-posting-patients-photo-without-consent-in-kuwait/","archiveUrl":"https://web.archive.org/web/20261005201624/https://www.arabtimesonline.com/news/doctor-penalized-for-posting-patients-photo-without-consent-in-kuwait/","theme":"sold_or_shared","status":"finding","id":"KWT-S001","pageUrl":"https://healthrecordrights.com/real-cases/#KWT-S001","countryUrl":"https://healthrecordrights.com/brief/kuwait/","why":"Shows a court treating a patient photo shared for advertising as disclosure of confidential medical information.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"KWT","country":"Kuwait","date":"2025-02-13","headline":"Top court rules on a doctor publishing a patient's photos in a hospital magazine","paraphrase":"A patient sought damages after a doctor published before-and-after photos in a hospital magazine. The appeal court found a confidentiality breach; the Court of Cassation held that patient consent, including implied consent, can lift the duty of secrecy.","source":"Al-Jarida","url":"https://www.aljarida.com/article/90133","theme":"sold_or_shared","status":"finding","id":"KWT-S002","pageUrl":"https://healthrecordrights.com/real-cases/#KWT-S002","countryUrl":"https://healthrecordrights.com/brief/kuwait/","why":"Sets out when sharing a patient's information is a breach and when consent, even implied, permits it.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"KGZ","country":"Kyrgyzstan","date":"2025-06-17","headline":"Data regulator finds private labs and clinics failing to protect patient data","paraphrase":"The state data protection agency inspected 17 private labs and diagnostic centres. It found no access limits, unclear retention, unrecorded patient consent to sharing, and weak IT security, and ordered fixes.","source":"Economist.kg","url":"https://economist.kg/novosti/2025/06/17/miedtsientry-i-laboratorii-kr-ulichili-v-narushienii-zakona-o-piersonalnykh-dannykh/","archiveUrl":"https://web.archive.org/web/20261005201117/https://economist.kg/novosti/2025/06/17/miedtsientry-i-laboratorii-kr-ulichili-v-narushienii-zakona-o-piersonalnykh-dannykh/","theme":"other","status":"finding","id":"KGZ-S001","pageUrl":"https://healthrecordrights.com/real-cases/#KGZ-S001","countryUrl":"https://healthrecordrights.com/brief/kyrgyzstan/","why":"Inspections showed patient data held without access controls, logs or documented consent for sharing.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"KGZ","country":"Kyrgyzstan","date":"2026-08-20","headline":"Bishkek patients told to take paper records home or risk losing them","paraphrase":"Readers said clinics urged them to collect paper outpatient records quickly or they might not be found in the archive. The health ministry confirmed it, saying uncollected cards stay archived and can be signed out.","source":"24.kg","url":"https://24.kg/obschestvo/385945_esche_prigodyatsya_vpoliklinikah_bishkeka_patsientov_prosyat_zabrat_medkartyi/","archiveUrl":"https://web.archive.org/web/20261005201136/https://24.kg/obschestvo/385945_esche_prigodyatsya_vpoliklinikah_bishkeka_patsientov_prosyat_zabrat_medkartyi/","theme":"other","status":"admitted","id":"KGZ-S002","pageUrl":"https://healthrecordrights.com/real-cases/#KGZ-S002","countryUrl":"https://healthrecordrights.com/brief/kyrgyzstan/","why":"As records go digital, patients carry the risk that older paper histories cannot be found later.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"LVA","country":"Latvia","date":"2026-08-03","headline":"Manager reprimanded for checking an employee's sick-leave record in the national health system","paraphrase":"A health worker who supervised a colleague opened the colleague's national health record to check whether sick leave was open. The person had restricted access to their health data. The regulator still found the lookup unlawful and issued a reprimand.","source":"Datu valsts inspekcija (Data State Inspectorate of Latvia)","url":"https://www.dvi.gov.lv/lv/media/5032/download?attachment","archiveUrl":"https://web.archive.org/web/20261005202445/https://www.dvi.gov.lv/lv/media/5032/download?attachment","theme":"breach","status":"finding","id":"LVA-S001","pageUrl":"https://healthrecordrights.com/real-cases/#LVA-S001","countryUrl":"https://healthrecordrights.com/brief/latvia/","why":"Staff with access to the national health system can look you up for workplace reasons that have nothing to do with care.","sourceType":"regulator_decision","lang":"lv","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"LVA","country":"Latvia","date":"2025-11-03","headline":"Health worker fined for reading a family member's national health record","paraphrase":"A health worker used work access to read an adult family member's national health record for personal reasons. The person said the information reached a third party. The regulator found no lawful basis and fined the worker 250 euros.","source":"Datu valsts inspekcija (Data State Inspectorate of Latvia)","url":"https://www.dvi.gov.lv/lv/media/4310/download?attachment","archiveUrl":"https://web.archive.org/web/20261005202516/https://www.dvi.gov.lv/lv/media/4310/download?attachment","theme":"breach","status":"finding","id":"LVA-S002","pageUrl":"https://healthrecordrights.com/real-cases/#LVA-S002","countryUrl":"https://healthrecordrights.com/brief/latvia/","why":"Work logins to the national record can be turned on family members; the person only learns of it later.","sourceType":"regulator_decision","lang":"lv","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"LVA","country":"Latvia","date":"2025-09-22","headline":"Hospital reprimanded after a software supplier's breach exposed patient and staff data","paraphrase":"Attackers reached a municipal system the hospital used, taking names, personal codes and addresses of its staff and clients. The regulator found the hospital had not supervised the supplier or reported on time, and reprimanded it. The hospital appealed.","source":"Datu valsts inspekcija (Data State Inspectorate of Latvia)","url":"https://www.dvi.gov.lv/lv/media/4403/download?attachment","theme":"breach","status":"finding","id":"LVA-S003","pageUrl":"https://healthrecordrights.com/real-cases/#LVA-S003","countryUrl":"https://healthrecordrights.com/brief/latvia/","why":"A hospital stays responsible for patient data it hands to suppliers, and must report a breach on time.","sourceType":"regulator_decision","lang":"lv","providerName":"SIA \"Liepājas reģionālā slimnīca\"","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"LVA","country":"Latvia","date":"2025-02-21","headline":"Regulator rejects mistyped-code excuse after a person's health record was opened","paraphrase":"A person complained that staff at a family practice they did not use had opened their record and prescriptions. The practice blamed a mistyped personal code. The regulator found the lookup unrelated to care and issued a reprimand.","source":"Datu valsts inspekcija (Data State Inspectorate of Latvia)","url":"https://www.dvi.gov.lv/lv/media/4112/download?attachment","archiveUrl":"https://web.archive.org/web/20261005202613/https://www.dvi.gov.lv/lv/media/4112/download?attachment","theme":"breach","status":"finding","id":"LVA-S004","pageUrl":"https://healthrecordrights.com/real-cases/#LVA-S004","countryUrl":"https://healthrecordrights.com/brief/latvia/","why":"A lookup in the national record can be challenged, and the regulator will test the excuse given.","sourceType":"regulator_decision","lang":"lv","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"LVA","country":"Latvia","date":"2024-12-03","headline":"Hospital physician assistant fined for repeatedly viewing three people's health records","paraphrase":"Over several years a physician assistant used work logins to the national health system and two hospital systems to view three people's health data for personal reasons. The regulator found no care purpose and fined him 500 euros.","source":"Datu valsts inspekcija (Data State Inspectorate of Latvia)","url":"https://www.dvi.gov.lv/lv/media/4259/download?attachment","archiveUrl":"https://web.archive.org/web/20261005202643/https://www.dvi.gov.lv/lv/media/4259/download?attachment","theme":"breach","status":"finding","id":"LVA-S005","pageUrl":"https://healthrecordrights.com/real-cases/#LVA-S005","countryUrl":"https://healthrecordrights.com/brief/latvia/","why":"Snooping can run for years across several hospital systems before anyone notices.","sourceType":"regulator_decision","lang":"lv","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"LBN","country":"Lebanon","date":"2025-01-13","headline":"Patient records from four Lebanese hospitals reportedly leaked on a dark web forum","paraphrase":"A report citing a dark web forum post said patient files from four hospitals, from 2010 to 2021, leaked with names, birth dates, passport numbers and plain-text passwords that reportedly still opened lab results.","source":"Cyber Press","url":"https://cyberpress.org/breach-hits-four-lebanese/","theme":"breach","status":"alleged","id":"LBN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#LBN-S001","countryUrl":"https://healthrecordrights.com/brief/lebanon/","why":"Leaked logins and file numbers could let strangers open patients' lab results and reports.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"LSO","country":"Lesotho","date":"2025-11-05","headline":"Former miners say missing cross-border records leave them unable to prove claims","paraphrase":"Former mineworkers home in Lesotho say incomplete mine records and poor coordination between South African and Lesotho authorities leave them without the proof a compensation fund requires. Some say they were refused with no reason given.","source":"Lesotho Times","url":"https://lestimes.com/?p=88916","theme":"lost_between_providers","status":"alleged","id":"LSO-S001","pageUrl":"https://healthrecordrights.com/real-cases/#LSO-S001","countryUrl":"https://healthrecordrights.com/brief/lesotho/","why":"Health records split between two countries can stop patients proving what happened to them and claiming what they are owed.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"LSO","country":"Lesotho","date":"2025-10-13","headline":"Former miner says a medical certification about him was kept from him for years","paraphrase":"A retired mineworker says a medical certification about him was made when he retired, but nobody told him until four years later, when he saw the certificate.","source":"MNN Centre for Investigative Journalism","url":"https://lescij.org/2025/10/13/the-lingering-scars-of-mining-how-south-african-mines-left-basotho-miners-to-die/","theme":"access_delay_or_cost","status":"alleged","id":"LSO-S002","pageUrl":"https://healthrecordrights.com/real-cases/#LSO-S002","countryUrl":"https://healthrecordrights.com/brief/lesotho/","why":"A finding recorded about a patient but not shared with them can delay care and cost them a claim.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"LBR","country":"Liberia","date":"2026-02-24","headline":"Hospital worker suspended after live broadcast from wards allegedly exposed patients' privacy","paraphrase":"A government agency suspended a hospital worker, accusing him of escorting journalists through wards and broadcasting live on social media. The agency said this exposed vulnerable patients and compromised their privacy, and ordered an investigation.","source":"GNN Liberia","url":"https://gnnliberia.com/moi-rejects-claims-of-law-targeting-weah/","archiveUrl":"https://web.archive.org/web/20261005201758/https://gnnliberia.com/moi-rejects-claims-of-law-targeting-weah/","theme":"breach","status":"alleged","id":"LBR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#LBR-S001","countryUrl":"https://healthrecordrights.com/brief/liberia/","why":"Shows that patients in a public hospital can have their privacy exposed by staff filming wards and streaming them online.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"LTU","country":"Lithuania","date":"2026-09-03","headline":"Regulator reprimands sanatorium for opening a patient's unrelated national e-health documents","paraphrase":"A patient saw in the national e-health log that a sanatorium's staff had opened a referral written for a different specialist. The regulator found no lawful basis for viewing it and reprimanded the sanatorium.","source":"Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate of Lithuania)","url":"https://vdai.lrv.lt/public/canonical/1788937777/1540/2026-09-03%20sprendimas%20Nr.%203R-1575%20(2.13-1.E).pdf","theme":"breach","status":"finding","id":"LTU-S001","pageUrl":"https://healthrecordrights.com/real-cases/#LTU-S001","countryUrl":"https://healthrecordrights.com/brief/lithuania/","why":"Any clinic you book with can open your national record; a view history let this patient prove overreach.","sourceType":"regulator_decision","lang":"lt","providerName":"UAB „Eglės sanatorija“","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"LTU","country":"Lithuania","date":"2026-06-19","headline":"Private clinic group fined 450,000 euros after two breaches of patient records","paraphrase":"A leaked staff login let an outsider open 63 patients' files, and a later ransomware attack hit systems holding records of about 383,000 patients. The regulator found security was inadequate and fined the company 450,000 euros.","source":"Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate of Lithuania)","url":"https://vdai.lrv.lt/public/canonical/1782465015/1462/2026-06-19%20sprendimas%20Nr.%203R-1143%20","theme":"breach","status":"finding","id":"LTU-S002","pageUrl":"https://healthrecordrights.com/real-cases/#LTU-S002","countryUrl":"https://healthrecordrights.com/brief/lithuania/","why":"Weak logins and open remote access put the medical records of hundreds of thousands of patients at risk.","sourceType":"regulator_decision","lang":"lt","providerName":"UAB InMedica","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"LTU","country":"Lithuania","date":"2026-06-05","headline":"Doctor fined for opening 1,231 patients' files and contacting them without a lawful basis","paraphrase":"While on sick leave and about to leave a public primary care centre, a doctor viewed 1,231 patients' files in its records system and used their contacts to email and text them. The regulator fined the doctor 1,153 euros.","source":"Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate of Lithuania)","url":"https://vdai.lrv.lt/public/canonical/1780997432/1430/2026-06-05%20sprendimas%20Nr.%203R-1040%20","theme":"sold_or_shared","status":"finding","id":"LTU-S003","pageUrl":"https://healthrecordrights.com/real-cases/#LTU-S003","countryUrl":"https://healthrecordrights.com/brief/lithuania/","why":"Records held for your care were opened and used to contact you for another purpose, without a lawful basis.","sourceType":"regulator_decision","lang":"lt","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"LTU","country":"Lithuania","date":"2025-08-20","headline":"Nurse logged a visit that never happened in a patient's national e-health record","paraphrase":"While handling a records transfer, a nurse at a health centre registered a visit the patient never made, then deleted it. The regulator accepted the centre's fixes and rejected the complaint as posing no real risk.","source":"Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate of Lithuania)","url":"https://vdai.lrv.lt/public/canonical/1755688163/1060/2025-08-20%20sprendimas%20Nr.%203R-1087%20(2.13-1.E).pdf","theme":"record_wrong","status":"finding","id":"LTU-S004","pageUrl":"https://healthrecordrights.com/real-cases/#LTU-S004","countryUrl":"https://healthrecordrights.com/brief/lithuania/","why":"A visit that never happened can be entered in your national record by a provider you never used.","sourceType":"regulator_decision","lang":"lt","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"LTU","country":"Lithuania","date":"2026-06-22","headline":"Clinic's system error sent health check invitations to women registered with other providers","paraphrase":"Women received text invitations from a clinic they had never used. The clinic blamed a backend fault in an information system shared with other providers, could not say how many people were reached, and said no data left the system.","source":"Respublika.lt (Vakaro žinios)","url":"https://www.respublika.lt/lt/naujienos/lietuva/kitos-lietuvos-zinios/ne-jiems-skirtas-sms-gave-pacientai-baiminasi-ar-nenutekejo-ju-duomenys/","theme":"record_wrong","status":"admitted","id":"LTU-S005","pageUrl":"https://healthrecordrights.com/real-cases/#LTU-S005","countryUrl":"https://healthrecordrights.com/brief/lithuania/","why":"When a shared system mixes up whose patient is whose, people cannot tell who holds their record or why.","sourceType":"journalism","lang":"lt","providerName":"Šeduvos poliklinika","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"LUX","country":"Luxembourg","date":"2026-09-09","headline":"Cyberattack on an IT firm serving doctors hit 40 medical practices","paraphrase":"An IT company serving medical practices said a cyberattack affected 40 practices. It filed a police complaint, notified the data protection authority and said experts found no data leak. Services were later restored.","source":"Le Quotidien","url":"https://lequotidien.lu/a-la-une/cyberattaque-dans-des-cabinets-medicaux-40-etablissements-en-ont-ete-victimes/","theme":"breach","status":"admitted","id":"LUX-S001","pageUrl":"https://healthrecordrights.com/real-cases/#LUX-S001","countryUrl":"https://healthrecordrights.com/brief/luxembourg/","why":"Practice records sit with outside IT firms; one attack there reached many doctors' patients at once.","sourceType":"journalism","lang":"fr","providerName":"BMS Engineering","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"MWI","country":"Malawi","date":"2026-03-09","headline":"Health minister ends group consultations that made patients share health details with strangers","paraphrase":"After posing as a patient at a public hospital, the health minister said several patients were seen together and had to describe their health problems in front of others. She ordered public facilities to see patients individually.","source":"Malawi24","url":"https://malawi24.com/2026/03/09/health-minister-bans-group-consultations-in-hospitals/","theme":"other","status":"admitted","id":"MWI-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MWI-S001","countryUrl":"https://healthrecordrights.com/brief/malawi/","why":"Patients forced to describe symptoms in front of strangers lose control over who learns their health information.","sourceType":"journalism","lang":"en","providerName":"Ministry of Health and Sanitation (Malawi)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"MYS","country":"Malaysia","date":"2025-04-18","headline":"Medical council suspends doctor who posted a patient's details on a clinic Facebook page","paraphrase":"The Malaysian Medical Council found a doctor guilty of posting a complainant's personal information on a clinic's Facebook page without written consent, failing to protect patient confidentiality, and suspended the doctor for two years.","source":"Malaysian Medical Council","url":"https://mmc.gov.my/wp-content/uploads/2025/04/DISCIPLINARY-PUNISHMENT-MEDICAL-ACT-1971-AMENDED-2012-2024.pdf","archiveUrl":"https://web.archive.org/web/20261005204027/https://mmc.gov.my/wp-content/uploads/2025/04/DISCIPLINARY-PUNISHMENT-MEDICAL-ACT-1971-AMENDED-2012-2024.pdf","theme":"sold_or_shared","status":"finding","id":"MYS-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MYS-S001","countryUrl":"https://healthrecordrights.com/brief/malaysia/","why":"A regulator treated public posting of a patient's details as serious enough to suspend a doctor for two years.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MYS","country":"Malaysia","date":"2025-04-18","headline":"Doctor reprimanded for posting a patient's confidential information on social media","paraphrase":"The Malaysian Medical Council found a doctor guilty of posting a patient's personal and medical information on a social media account without written consent, against a promise not to reveal it, and issued a reprimand.","source":"Malaysian Medical Council","url":"https://mmc.gov.my/wp-content/uploads/2025/04/DISCIPLINARY-PUNISHMENT-MEDICAL-ACT-1971-AMENDED-2012-2024.pdf","archiveUrl":"https://web.archive.org/web/20261005204027/https://mmc.gov.my/wp-content/uploads/2025/04/DISCIPLINARY-PUNISHMENT-MEDICAL-ACT-1971-AMENDED-2012-2024.pdf","theme":"sold_or_shared","status":"finding","id":"MYS-S002","pageUrl":"https://healthrecordrights.com/real-cases/#MYS-S002","countryUrl":"https://healthrecordrights.com/brief/malaysia/","why":"Shows the regulator acting when a doctor broke a promise of confidentiality and put patient details online.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MYS","country":"Malaysia","date":"2025-04-18","headline":"Doctor reprimanded after a requested medical report took about ten months to arrive","paraphrase":"The Malaysian Medical Council found that a doctor supplied a requested medical report roughly ten months after the request, failing to provide it within a reasonable time, and reprimanded the doctor along with a separate charge.","source":"Malaysian Medical Council","url":"https://mmc.gov.my/wp-content/uploads/2025/04/DISCIPLINARY-PUNISHMENT-MEDICAL-ACT-1971-AMENDED-2012-2024.pdf","archiveUrl":"https://web.archive.org/web/20261005204027/https://mmc.gov.my/wp-content/uploads/2025/04/DISCIPLINARY-PUNISHMENT-MEDICAL-ACT-1971-AMENDED-2012-2024.pdf","theme":"access_delay_or_cost","status":"finding","id":"MYS-S003","pageUrl":"https://healthrecordrights.com/real-cases/#MYS-S003","countryUrl":"https://healthrecordrights.com/brief/malaysia/","why":"Confirms that a long wait for a medical report can breach professional rules, not just patience.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MYS","country":"Malaysia","date":"2025-04-18","headline":"Doctor reprimanded for filing a patient's medical report in court without consent","paraphrase":"The Malaysian Medical Council found a doctor guilty of disclosing a complainant's medical report, without consent, in an affidavit filed in court proceedings against the complainant, and issued a reprimand.","source":"Malaysian Medical Council","url":"https://mmc.gov.my/wp-content/uploads/2025/04/DISCIPLINARY-PUNISHMENT-MEDICAL-ACT-1971-AMENDED-2012-2024.pdf","archiveUrl":"https://web.archive.org/web/20261005204027/https://mmc.gov.my/wp-content/uploads/2025/04/DISCIPLINARY-PUNISHMENT-MEDICAL-ACT-1971-AMENDED-2012-2024.pdf","theme":"sold_or_shared","status":"finding","id":"MYS-S004","pageUrl":"https://healthrecordrights.com/real-cases/#MYS-S004","countryUrl":"https://healthrecordrights.com/brief/malaysia/","why":"A patient's own report was used against them in a court filing; the regulator called it improper disclosure.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MDV","country":"Maldives","date":"2025-10-05","headline":"Lawyers say a public hospital broke the law by publishing a patient's health details","paraphrase":"A public hospital released a statement giving health details of a named patient. Lawyers said this broke the patient confidentiality article of the Health Services Act, which allows disclosure only with written consent, a court order or a legal duty.","source":"The Edition","url":"https://edition.mv/news/44816","archiveUrl":"https://web.archive.org/web/20261005202829/https://edition.mv/news/44816","theme":"sold_or_shared","status":"alleged","id":"MDV-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MDV-S001","countryUrl":"https://healthrecordrights.com/brief/maldives/","why":"The law keeps patient information confidential unless the patient consents; a hospital statement can expose it to everyone.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MDV","country":"Maldives","date":"2025-02-05","headline":"Health Ministry investigates hospital after a patient's images and identity were leaked online","paraphrase":"A patient's clinical images were reportedly leaked by a hospital nurse and shared online with identity details. The Health Ministry said it was investigating; whether anyone faced action was not disclosed.","source":"The Edition","url":"https://edition.mv/news/39292","archiveUrl":"https://web.archive.org/web/20261005202847/https://edition.mv/news/39292","theme":"breach","status":"alleged","id":"MDV-S002","pageUrl":"https://healthrecordrights.com/real-cases/#MDV-S002","countryUrl":"https://healthrecordrights.com/brief/maldives/","why":"Images from a patient's file were posted publicly with identity details, and no outcome of the inquiry was reported.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MLT","country":"Malta","date":"2025-04-30","headline":"Health provider employee opened a patient's record for personal reasons, regulator finds","paraphrase":"A staff member with no role in the patient's care opened their record for personal reasons. The regulator found the access unauthorised. The provider had dismissed the employee and told the patient, so no further action followed.","source":"Information and Data Protection Commissioner (Malta)","url":"https://idpc.org.mt/wp-content/uploads/2025/05/0547_001.pdf","archiveUrl":"https://web.archive.org/web/20261005203235/https://idpc.org.mt/wp-content/uploads/2025/05/0547_001.pdf","theme":"breach","status":"finding","id":"MLT-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MLT-S001","countryUrl":"https://healthrecordrights.com/brief/malta/","why":"Shows staff can open records of people they know; patients may only learn of it if the provider audits access and tells them.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MLT","country":"Malta","date":"2025-04-02","headline":"Clinic kept a wrong address after repeated requests and posted health reports there","paraphrase":"A private provider filled in a patient's file with an address taken from the electoral register, years out of date. Despite repeated requests it did not correct it, and medical reports reached the current occupants. Fines totalled €20,000.","source":"Information and Data Protection Commissioner (Malta)","url":"https://idpc.org.mt/wp-content/uploads/2025/04/0476_001.pdf","archiveUrl":"https://web.archive.org/web/20261005203249/https://idpc.org.mt/wp-content/uploads/2025/04/0476_001.pdf","theme":"record_wrong","status":"finding","id":"MLT-S002","pageUrl":"https://healthrecordrights.com/real-cases/#MLT-S002","countryUrl":"https://healthrecordrights.com/brief/malta/","why":"A wrong detail in a record, left uncorrected, sent sensitive results to strangers; correction rights matter.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MLT","country":"Malta","date":"2025-03-14","headline":"Court protects patient's complaint that a former doctor kept reading her records","paraphrase":"A patient complained to the data protection regulator that a doctor kept accessing her medical records after she left his care. He sued her for libel. A court dismissed the suit, ruling her complaints were privileged.","source":"Newsbook","url":"https://newsbook.com.mt/ginekologu-jitlef-libell-fuq-talbiet-ta-access-ghall-informazzjoni-minn-eks-pazjenta/","theme":"breach","status":"alleged","id":"MLT-S003","pageUrl":"https://healthrecordrights.com/real-cases/#MLT-S003","countryUrl":"https://healthrecordrights.com/brief/malta/","why":"Patients who complain about who reads their records can face lawsuits; this court held such complaints are privileged.","sourceType":"journalism","lang":"mt","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"MUS","country":"Mauritius","date":"2025-06-20","headline":"Health minister tells parliament patient files went missing in public hospitals","paraphrase":"The health minister said 19 patient files had been reported missing in public hospitals since November 2024, and 349 files and 24 consultation cards were not available when needed because they sat in other departments. All were later found.","source":"L'Express (Maurice), via allAfrica","url":"https://fr.allafrica.com/stories/202506200487.html","theme":"lost_between_providers","status":"admitted","id":"MUS-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MUS-S001","countryUrl":"https://healthrecordrights.com/brief/mauritius/","why":"When a file goes missing, the next doctor treats a patient without the history, relying on old reports and temporary files.","sourceType":"journalism","lang":"fr","providerName":"Ministry of Health and Wellness (Mauritius)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"MUS","country":"Mauritius","date":"2025-12-19","headline":"Patient says a private doctor refused her report needed for a benefits board","paraphrase":"A patient says the doctor who treated her at a private clinic refused her a detailed report of her care. A social security doctor asked too and was refused. She needs it for a medical board.","source":"Le Mauricien","url":"https://www.lemauricien.com/actualites/societe/operation-contestee-une-patiente-accuse-un-medecin-de-lui-refuser-son-dossier-medical/694296/","archiveUrl":"https://web.archive.org/web/20261005203932/https://www.lemauricien.com/actualites/societe/operation-contestee-une-patiente-accuse-un-medecin-de-lui-refuser-son-dossier-medical/694296/","theme":"access_refused","status":"alleged","id":"MUS-S002","pageUrl":"https://healthrecordrights.com/real-cases/#MUS-S002","countryUrl":"https://healthrecordrights.com/brief/mauritius/","why":"Without her own report a patient cannot get a second opinion or go before the social security medical board.","sourceType":"journalism","lang":"fr","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MUS","country":"Mauritius","date":"2026-04","headline":"Hospital records staff say half-empty offices make patients return for their cards","paraphrase":"Health records clerks in public hospitals say their departments run with about half the staff they should have. Some counters close, so patients must come back the next day to collect their card and learn their follow-up date.","source":"Le Defi Media Group","url":"https://defimedia.info/hopitaux-publics-les-health-records-clerks-bout-de-souffle","theme":"access_delay_or_cost","status":"alleged","id":"MUS-S003","pageUrl":"https://healthrecordrights.com/real-cases/#MUS-S003","countryUrl":"https://healthrecordrights.com/brief/mauritius/","why":"When records offices are short of staff, patients wait longer and make extra trips just to get their card and next appointment.","sourceType":"journalism","lang":"fr","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"MEX","country":"Mexico","date":"2025-01-27","headline":"Public insurer answered late and incompletely when a patient asked for scans","paraphrase":"A person asked a public health insurer for copies of their imaging studies and the reports on them. The insurer missed the legal deadline and only found the files after a complaint. The regulator ordered delivery free of charge.","source":"Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI/013/2025)","url":"https://home.inai.org.mx/wp-content/documentos/SalaDePrensa/Comunicados/Nota%20INAI-013-25.pdf","theme":"access_delay_or_cost","status":"finding","id":"MEX-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MEX-S001","countryUrl":"https://healthrecordrights.com/brief/mexico/","why":"Patients own their records; a public insurer that misses deadlines can be ordered to hand them over.","sourceType":"regulator_decision","lang":"es","providerName":"Instituto de Seguridad y Servicios Sociales de los Trabajadores del Estado (ISSSTE)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"MEX","country":"Mexico","date":"2024-10-03","headline":"Asked for a late father's record, a person was given someone else's","paraphrase":"A person paid a public insurer for certified copies of their deceased father's record but was handed a relative's record instead. After a complaint, the insurer found the father's file. The regulator ordered free certified copies.","source":"Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI/142/2024)","url":"https://home.inai.org.mx/wp-content/documentos/SalaDePrensa/Comunicados/Nota%20INAI-142-24.pdf","archiveUrl":"https://web.archive.org/web/20261005202925/https://home.inai.org.mx/wp-content/documentos/SalaDePrensa/Comunicados/Nota%20INAI-142-24.pdf","theme":"access_refused","status":"finding","id":"MEX-S002","pageUrl":"https://healthrecordrights.com/real-cases/#MEX-S002","countryUrl":"https://healthrecordrights.com/brief/mexico/","why":"A person paid for certified copies and received the wrong file; only the regulator's order fixed it.","sourceType":"regulator_decision","lang":"es","providerName":"Instituto Mexicano del Seguro Social (IMSS)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MEX","country":"Mexico","date":"2026-08-26","headline":"Court says judges can act at once when a clinic withholds a patient's record","paraphrase":"A federal appeals court ruled that when a person says a health institution is denying access to their clinical record, judges may grant immediate protection, treating record access as part of the right to health.","source":"La Silla Rota","url":"https://lasillarota.com/nacion/2026/8/26/el-hospital-o-doctor-te-niegan-acceso-a-tu-expediente-clinico-esto-dice-la-justicia-526020.html","theme":"access_refused","status":"finding","id":"MEX-S003","pageUrl":"https://healthrecordrights.com/real-cases/#MEX-S003","countryUrl":"https://healthrecordrights.com/brief/mexico/","why":"Patients refused their own file can get fast court protection instead of waiting months.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"MEX","country":"Mexico","date":"2025-07-03","headline":"Records of a private hospital group's patients offered for sale online","paraphrase":"A seller claimed to offer 400,000 lines of data from a private hospital group: patients' names, national ID and tax numbers, phones, emails, insurance policies, diagnoses and medical notes. The report carried no response from the hospital.","source":"Publimetro México","url":"https://www.publimetro.com.mx/noticias/2025/07/03/hacker-vende-400-mil-datos-sensibles-de-pacientes-del-hospital-espanol-de-mexico/","archiveUrl":"https://web.archive.org/web/20261005203023/https://www.publimetro.com.mx/noticias/2025/07/03/hacker-vende-400-mil-datos-sensibles-de-pacientes-del-hospital-espanol-de-mexico/","theme":"breach","status":"alleged","id":"MEX-S004","pageUrl":"https://healthrecordrights.com/real-cases/#MEX-S004","countryUrl":"https://healthrecordrights.com/brief/mexico/","why":"Stolen hospital files carry national ID numbers and insurance details, raising fraud risk for patients.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MEX","country":"Mexico","date":"2026-02-09","headline":"Patient details from a public hospital in Jalisco reportedly sold after cyberattack","paraphrase":"A report says a cyberattack exposed patients' names, addresses, phones, emails and diagnoses, later offered for sale. The hospital filed a criminal complaint; earlier it said only part of a website was hit and patient records were safe.","source":"N+ (Nmas)","url":"https://www.nmas.com.mx/seguridad/hackeo-hospital-civil-guadalajara-datos-medicos-expuestos-se-vendian-foros-clandestinos/","archiveUrl":"https://web.archive.org/web/20261005203119/https://www.nmas.com.mx/seguridad/hackeo-hospital-civil-guadalajara-datos-medicos-expuestos-se-vendian-foros-clandestinos/","theme":"breach","status":"alleged","id":"MEX-S005","pageUrl":"https://healthrecordrights.com/real-cases/#MEX-S005","countryUrl":"https://healthrecordrights.com/brief/mexico/","why":"Patients may not know their details are being sold, especially when the hospital says nothing was taken.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"FSM","country":"Micronesia","date":"2025-03-16","headline":"Ransomware forces Yap health department to shut down its computer network","paraphrase":"Ransomware hit the Yap State health department's network. The department shut down every computer and its digital health systems, said so in a public notice, and kept serving patients more slowly while systems were rebuilt.","source":"Security Affairs","url":"https://securityaffairs.com/175445/cyber-crime/a-ransomware-attack-hit-the-micronesian-state-of-yap.html","archiveUrl":"https://web.archive.org/web/20261005170113/https://securityaffairs.com/175445/cyber-crime/a-ransomware-attack-hit-the-micronesian-state-of-yap.html","theme":"breach","status":"admitted","id":"FSM-S001","pageUrl":"https://healthrecordrights.com/real-cases/#FSM-S001","countryUrl":"https://healthrecordrights.com/brief/micronesia/","why":"With no data protection law, patients have no right to be told whether their records were taken.","sourceType":"journalism","lang":"en","providerName":"Yap State Department of Health Services","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MDA","country":"Moldova","date":"2025-02-14","headline":"Regulator finds private laboratory left patients' test results open on its website","paraphrase":"A patient found that other people's test results on a large private laboratory's website could be opened by changing digits in a link. The data protection regulator found the laboratory failed to secure them and opened an administrative case.","source":"NewsMaker","url":"https://newsmaker.md/ru/doc-v-moldove-protiv-laboratorii-alfa-diagnostica-vozbudili-administrativnoe-delo-iz-za-utechki-meditsinskih-dannyh","theme":"breach","status":"finding","id":"MDA-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MDA-S001","countryUrl":"https://healthrecordrights.com/brief/moldova/","why":"Lab results carrying names, addresses and ID numbers were open to anyone until a patient noticed.","sourceType":"journalism","lang":"ru","providerName":"SRL Alfa Diagnostica","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"MDA","country":"Moldova","date":"2026-05-20","headline":"National health insurer confirms cyberattack that may have taken patient data","paraphrase":"The national health insurer said attackers hit one of its information systems and technical checks pointed to a possible data exfiltration. Its director later said no leak had yet appeared online and the investigation was continuing.","source":"Moldova 1 (Teleradio-Moldova)","url":"https://moldova1.md/p/76505/ion-dodon-nu-exista-dovezi-ca-datele-pacientilor-au-fost-scurse-dupa-atacul-cibernetic-asupra-sistemului-de-asigurari-in-medicina","archiveUrl":"https://web.archive.org/web/20261005202738/https://moldova1.md/p/76505/ion-dodon-nu-exista-dovezi-ca-datele-pacientilor-au-fost-scurse-dupa-atacul-cibernetic-asupra-sistemului-de-asigurari-in-medicina","theme":"breach","status":"admitted","id":"MDA-S002","pageUrl":"https://healthrecordrights.com/real-cases/#MDA-S002","countryUrl":"https://healthrecordrights.com/brief/moldova/","why":"A national system holding patient and payment data was breached, and people still do not know what was taken.","sourceType":"journalism","lang":"ro","providerName":"Compania Națională de Asigurări în Medicină (CNAM)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MCO","country":"Monaco","date":"2026-09-10","headline":"Monaco hospital apologises after exposing hundreds of blood donors' email addresses","paraphrase":"A mass email inviting donors to a blood drive showed every recipient's address. Hundreds of donors were affected. The hospital apologised the next day and said no health or donation history was shared.","source":"La Gazette de Monaco","url":"https://lagazettedemonaco.com/actualites/societe/le-chpg-presente-ses-excuses-apres-une-fuite-de-donnees","archiveUrl":"https://web.archive.org/web/20261005202705/https://lagazettedemonaco.com/actualites/societe/le-chpg-presente-ses-excuses-apres-une-fuite-de-donnees","theme":"breach","status":"admitted","id":"MCO-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MCO-S001","countryUrl":"https://healthrecordrights.com/brief/monaco/","why":"A routine group email can reveal who gives blood at a hospital; contact lists held by health services need the same care as records.","sourceType":"journalism","lang":"fr","providerName":"Centre Hospitalier Princesse Grace (CHPG)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MNG","country":"Mongolia","date":"2025-03-31","headline":"Rights commission finds Intermed hospital failed to protect patient data before a cyberattack","paraphrase":"After hackers took and posted names, ID and phone numbers of about 200,000 patients, a patient complained. The commission found weak cyber security, no rules for handling personal data and no breach plan, and ordered an audit and fixes.","source":"National Human Rights Commission of Mongolia, 24th report on human rights","url":"https://nhrcm.gov.mn/pdf/KHUNII_ERKHI_24_deh_iltgel.pdf","archiveUrl":"https://web.archive.org/web/20261005203737/https://nhrcm.gov.mn/pdf/KHUNII_ERKHI_24_deh_iltgel.pdf","theme":"breach","status":"finding","id":"MNG-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MNG-S001","countryUrl":"https://healthrecordrights.com/brief/mongolia/","why":"The data protection regulator found a large hospital had no breach plan, so patients were left exposed after their data spread online.","sourceType":"regulator_decision","lang":"mn","providerName":"Intermed Hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MNG","country":"Mongolia","date":"2025-03-31","headline":"Rights commission finds a hospital head gave a patient's health details to a reporter","paraphrase":"A relative complained that a hospital head described a patient's health in a live interview with a news site. The commission found this broke the personal data law; the hospital head was warned and the press council asked to review.","source":"National Human Rights Commission of Mongolia, 24th report on human rights","url":"https://nhrcm.gov.mn/pdf/KHUNII_ERKHI_24_deh_iltgel.pdf","archiveUrl":"https://web.archive.org/web/20261005203737/https://nhrcm.gov.mn/pdf/KHUNII_ERKHI_24_deh_iltgel.pdf","theme":"sold_or_shared","status":"finding","id":"MNG-S002","pageUrl":"https://healthrecordrights.com/real-cases/#MNG-S002","countryUrl":"https://healthrecordrights.com/brief/mongolia/","why":"Health details are private by law; a hospital chief sharing them on air shows how easily a record leaves the clinic.","sourceType":"regulator_decision","lang":"mn","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MNG","country":"Mongolia","date":"2024-11-11","headline":"Intermed apologises after hackers took patient data; one patient says nobody called","paraphrase":"Hackers demanded $50,000 for data said to include patients' names, ID numbers, phone numbers and medical histories. The hospital publicly apologised for the risk of leaked data. One patient said they reported it to police; the promised call never came.","source":"Mass.mn","url":"https://mass.mn/n/97222","archiveUrl":"https://web.archive.org/web/20261005203812/https://mass.mn/n/97222","theme":"breach","status":"admitted","id":"MNG-S003","pageUrl":"https://healthrecordrights.com/real-cases/#MNG-S003","countryUrl":"https://healthrecordrights.com/brief/mongolia/","why":"When a hospital loses patient records, people need to be told quickly so they can protect themselves.","sourceType":"journalism","lang":"mn","providerName":"Intermed Hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MNE","country":"Montenegro","date":"2025-10-31","headline":"Ombudsman holds hospital responsible after a patient's medical report surfaced in court","paraphrase":"A specialist's report on a patient was printed from the hospital system using an absent doctor's login and read aloud in a public trial. The ombudsman found the hospital responsible for failing to protect the data.","source":"Portal ETV (from Pobjeda)","url":"https://etv.me/drustvo/kccg-uveo-ugovore-o-tajnosti-advokatu-micovicu-odgovornost-ne-traze","archiveUrl":"https://web.archive.org/web/20261005203427/https://etv.me/drustvo/kccg-uveo-ugovore-o-tajnosti-advokatu-micovicu-odgovornost-ne-traze","theme":"breach","status":"finding","id":"MNE-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MNE-S001","countryUrl":"https://healthrecordrights.com/brief/montenegro/","why":"A hospital record printed under an absent doctor's login reached a courtroom, and months later nobody had been held to account.","sourceType":"journalism","lang":"sr","providerName":"Klinički centar Crne Gore (KCCG)","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MNE","country":"Montenegro","date":"2026-09-24","headline":"Regulator orders hospital to stop filming patients in waiting areas and delete footage","paraphrase":"After an anonymous complaint, the data protection agency inspected a hospital and found cameras covering areas where patients wait. It ordered one camera redirected or masked and the unlawful recordings deleted; the hospital reported compliance.","source":"CdM","url":"https://www.cdm.me/drustvo/agencija-utvrdila-nepravilnosti-u-kbc-berane-zbog-video-nadzora/","archiveUrl":"https://web.archive.org/web/20261005203449/https://www.cdm.me/drustvo/agencija-utvrdila-nepravilnosti-u-kbc-berane-zbog-video-nadzora/","theme":"other","status":"finding","id":"MNE-S002","pageUrl":"https://healthrecordrights.com/real-cases/#MNE-S002","countryUrl":"https://healthrecordrights.com/brief/montenegro/","why":"Patients at a hospital were filmed where they sat waiting, and only an inspection forced the cameras turned and recordings erased.","sourceType":"journalism","lang":"sr","providerName":"Kliničko bolnički centar Berane","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MNE","country":"Montenegro","date":"2026-07-06","headline":"National health record system down for days, patients unable to view results online","paraphrase":"Patients reported that the national health information system and the eHealth portal were unavailable for several days, so results could not be checked online and prescriptions were issued on paper. The ministry confirmed temporary technical problems.","source":"Portal 24kroz7 (from Dan)","url":"https://24kroz7.com/drustvo/krah-zdravstvenog-sistema-crna-gora-danima-bila-bez-elektronskih-recepata-i-uputa/","archiveUrl":"https://web.archive.org/web/20261005203512/https://24kroz7.com/drustvo/krah-zdravstvenog-sistema-crna-gora-danima-bila-bez-elektronskih-recepata-i-uputa/","theme":"access_delay_or_cost","status":"admitted","id":"MNE-S003","pageUrl":"https://healthrecordrights.com/real-cases/#MNE-S003","countryUrl":"https://healthrecordrights.com/brief/montenegro/","why":"When the shared system fails, patients lose online access to their own results and bookings and fall back on paper.","sourceType":"journalism","lang":"sr","providerName":"Ministarstvo zdravlja Crne Gore","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MNE","country":"Montenegro","date":"2026-04-27","headline":"Patient says a third party learned details of her treatment from a clinic","paraphrase":"A patient complained that an outsider obtained exact details of her care from a public health centre. The data protection agency could not confirm a leak because staff denied it; she received no sign of an internal inquiry.","source":"Standard (from Pobjeda)","url":"https://standard.co.me/drustvo/tisina-koja-kosta-pola-miliona-zastarjeli-zakoni-ne-prate-razvoj-tehnologija","theme":"breach","status":"alleged","id":"MNE-S004","pageUrl":"https://healthrecordrights.com/real-cases/#MNE-S004","countryUrl":"https://healthrecordrights.com/brief/montenegro/","why":"Even with a regulator inspection, a patient could not find out whether her record leaked, and nobody answered for it.","sourceType":"journalism","lang":"sr","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"MNE","country":"Montenegro","date":"2025-10-25","headline":"Hospital says no staff disciplined over patient data leaks, adds confidentiality contracts","paraphrase":"Asked by a newspaper, the hospital said no employee had been held responsible for recent leaks of patients' health information. It said all staff must now sign confidentiality contracts to stop disclosures to third parties.","source":"Vijesti","url":"https://www.vijesti.me/vijesti/drustvo/780421/klinicki-bez-flastera-za-curenje-podataka-do-javnosti-stizu-dijagnoze-ali-broj-disciplinskih-postupaka-zanemarljiv","theme":"breach","status":"admitted","id":"MNE-S005","pageUrl":"https://healthrecordrights.com/real-cases/#MNE-S005","countryUrl":"https://healthrecordrights.com/brief/montenegro/","why":"Leaks of patient information went unpunished; the hospital's answer was a new contract, not accountability.","sourceType":"journalism","lang":"sr","providerName":"Klinički centar Crne Gore (KCCG)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"MOZ","country":"Mozambique","date":"2025-12-16","headline":"Government confirms new US health deal includes sharing health data and samples","paraphrase":"Reporting a health ministry statement, the outlet says a five-year US funding memorandum includes an agreement to share national health data and biological samples, which the government says will follow national data protection rules.","source":"Carta de Moçambique","url":"https://cartamz.com/destaque/48260/mocambique-e-eua-assinam-acordo-de-17-mil-milhoes-de-dolares-na-saude/","theme":"sold_or_shared","status":"admitted","id":"MOZ-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MOZ-S001","countryUrl":"https://healthrecordrights.com/brief/mozambique/","why":"Patients' health data can leave the country under a funding deal, with no data protection law yet in force.","sourceType":"journalism","lang":"pt","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"MOZ","country":"Mozambique","date":"2026-09-14","headline":"Rights activist asks whether patients' clinical data will be sent abroad under US deal","paraphrase":"A civil society leader says the terms of the health data sharing agreement are opaque and asks the ministry to publish them, including whether data sent abroad is anonymised or individual clinical records, and how long it is kept.","source":"MZNews","url":"https://mznews.co.mz/adriano-nuvunga-exige-explicacoes-sobre-partilha-de-dados-de-saude-entre-mocambique-e-eua/","archiveUrl":"https://web.archive.org/web/20261005203854/https://mznews.co.mz/adriano-nuvunga-exige-explicacoes-sobre-partilha-de-dados-de-saude-entre-mocambique-e-eua/","theme":"sold_or_shared","status":"alleged","id":"MOZ-S002","pageUrl":"https://healthrecordrights.com/real-cases/#MOZ-S002","countryUrl":"https://healthrecordrights.com/brief/mozambique/","why":"Patients cannot tell whether their identifiable records leave the country, or who checks how they are kept.","sourceType":"journalism","lang":"pt","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MMR","country":"Myanmar","date":"2026-08-09","headline":"Hospital staff alert the military before treating emergency patients, people nearby say","paraphrase":"People close to a military-guarded public hospital in Sagaing Region say staff notify the army when emergency patients arrive, and treatment waits until soldiers and police have checked them, so patient details reach security forces first.","source":"Democratic Voice of Burma (DVB)","url":"https://burmese.dvb.no/post/925240","archiveUrl":"https://web.archive.org/web/20261005203402/https://burmese.dvb.no/post/925240","theme":"sold_or_shared","status":"alleged","id":"MMR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MMR-S001","countryUrl":"https://healthrecordrights.com/brief/myanmar/","why":"Patients' arrival and details go to soldiers and police before care, with no consent and delays to treatment.","sourceType":"journalism","lang":"my","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NAM","country":"Namibia","date":"2026-03-19","headline":"State hospital admits patient files sat on floors and old beds","paraphrase":"Photos showed patient files on a hospital floor, some soaked. Hospital management said it ran out of storage space, kept files on unusable beds, and acknowledged the store did not comply with archives law.","source":"The Namibian","url":"https://www.namibian.com.na/oshakati-hospital-stores-records-on-floor-old-beds/","theme":"other","status":"admitted","id":"NAM-S001","pageUrl":"https://healthrecordrights.com/real-cases/#NAM-S001","countryUrl":"https://healthrecordrights.com/brief/namibia/","why":"Paper files stored on wet floors can be damaged or lost, leaving the next doctor without a patient's history.","sourceType":"journalism","lang":"en","providerName":"Oshakati State Hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NAM","country":"Namibia","date":"2024-12-17","headline":"Health ministry confirms hackers breached one of its medicine data systems","paraphrase":"After a national telecom data leak, the health ministry confirmed attackers breached an internet-facing pharmaceutical dashboard. It said only counts of patients using services were exposed, not personal details, and took the system offline.","source":"The Namibian","url":"https://www.namibian.com.na/health-ministry-systems-hacked-after-telecom-leak/","archiveUrl":"https://web.archive.org/web/20261005204231/https://www.namibian.com.na/health-ministry-systems-hacked-after-telecom-leak/","theme":"breach","status":"admitted","id":"NAM-S002","pageUrl":"https://healthrecordrights.com/real-cases/#NAM-S002","countryUrl":"https://healthrecordrights.com/brief/namibia/","why":"Health systems published on the open internet can be reached by attackers; patients rely on the ministry's own account of what leaked.","sourceType":"journalism","lang":"en","providerName":"Ministry of Health and Social Services","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NPL","country":"Nepal","date":"2026-07-01","headline":"Insurance claims filed in a patient's name for care that never took place","paraphrase":"A newspaper reports that a hospital submitted a claim with false bills for care it never gave an insured patient, and repeat claims for one patient, before the Health Insurance Board spotted and rejected them.","source":"Naya Patrika","url":"https://www.nayapatrikadaily.com/news-details/198797/2026-07-01","theme":"record_wrong","status":"alleged","id":"NPL-S001","pageUrl":"https://healthrecordrights.com/real-cases/#NPL-S001","countryUrl":"https://healthrecordrights.com/brief/nepal/","why":"False entries in a patient's insurance file can follow them into later claims and leave a wrong history on record.","sourceType":"journalism","lang":"ne","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NPL","country":"Nepal","date":"2026-03-23","headline":"Hospital operators charged with faking visitors' medical records in insurance scheme","paraphrase":"Prosecutors charged 32 people, including hospital operators and doctors, accused of fabricating records and issuing separate bills for patients on one flight to support inflated insurance claims for foreign trekkers.","source":"The Kathmandu Post","url":"https://kathmandupost.com/national/2026/03/23/nepal-charges-32-in-fake-rescue-scam","theme":"record_wrong","status":"alleged","id":"NPL-S002","pageUrl":"https://healthrecordrights.com/real-cases/#NPL-S002","countryUrl":"https://healthrecordrights.com/brief/nepal/","why":"Forged hospital records put false entries in a person's medical history and can be used against them by insurers.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NPL","country":"Nepal","date":"2026-02-01","headline":"National health insurance system failure left months of claims data out of reach","paraphrase":"A guest editorial reports that Nepal's national health insurance information system failed, making months of claims inaccessible overnight; hospitals struggled to recover the data, while some with their own electronic records resubmitted claims.","source":"Nepali Times","url":"https://nepalitimes.com/fix-what-is-broken","theme":"other","status":"alleged","id":"NPL-S003","pageUrl":"https://healthrecordrights.com/real-cases/#NPL-S003","countryUrl":"https://healthrecordrights.com/brief/nepal/","why":"When a national system loses access to claims data, the records behind patients' care and coverage are put at risk.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NLD","country":"Netherlands","date":"2026-04-14","headline":"Nurse reprimanded for repeatedly opening patient files with no care reason","paraphrase":"A hospital's log checks showed a nurse had opened the electronic files of several patients he was not treating, more than once and over a long period. He admitted it, citing curiosity and boredom. The tribunal reprimanded him.","source":"Regionaal Tuchtcollege voor de Gezondheidszorg Amsterdam","url":"https://tuchtrecht.overheid.nl/ECLI_NL_TGZRAMS_2026_80","theme":"breach","status":"finding","id":"NLD-S001","pageUrl":"https://healthrecordrights.com/real-cases/#NLD-S001","countryUrl":"https://healthrecordrights.com/brief/netherlands/","why":"Access logs caught a staff member reading strangers' records out of curiosity; patients rely on such checks.","sourceType":"court_judgment","lang":"nl","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NLD","country":"Netherlands","date":"2025-02-03","headline":"Appeal tribunal upholds complaint that a surgeon refused to hand over a medical file","paraphrase":"A patient complained that her surgeon refused to provide her medical file, among other complaints. On appeal, the national disciplinary tribunal found the complaint about the file partly justified, and the reprimand stayed in place.","source":"Centraal Tuchtcollege voor de Gezondheidszorg","url":"https://tuchtrecht.overheid.nl/zoeken/resultaat/uitspraak/2025/ECLI_NL_TGZCTG_2025_19","archiveUrl":"https://web.archive.org/web/20261005204629/https://tuchtrecht.overheid.nl/zoeken/resultaat/uitspraak/2025/ECLI_NL_TGZCTG_2025_19","theme":"access_refused","status":"finding","id":"NLD-S002","pageUrl":"https://healthrecordrights.com/real-cases/#NLD-S002","countryUrl":"https://healthrecordrights.com/brief/netherlands/","why":"Patients have a right to their own file; a refusal can end in a disciplinary ruling.","sourceType":"court_judgment","lang":"nl","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NLD","country":"Netherlands","date":"2024-11-13","headline":"Doctor reprimanded for giving a patient's records to an outside expert without consent","paraphrase":"During a civil case he brought against a patient, a doctor passed her medical data to an outside expert without asking her. The tribunal found confidentiality was breached and reprimanded him.","source":"Regionaal Tuchtcollege voor de Gezondheidszorg 's-Hertogenbosch","url":"https://tuchtrecht.overheid.nl/ECLI:NL:TGZRSHE:2024:125","archiveUrl":"https://web.archive.org/web/20261005204647/https://tuchtrecht.overheid.nl/ECLI:NL:TGZRSHE:2024:125","theme":"sold_or_shared","status":"finding","id":"NLD-S003","pageUrl":"https://healthrecordrights.com/real-cases/#NLD-S003","countryUrl":"https://healthrecordrights.com/brief/netherlands/","why":"A doctor in a dispute with a patient still may not pass on her records without first asking her.","sourceType":"court_judgment","lang":"nl","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NLD","country":"Netherlands","date":"2025-08-11","headline":"Hackers took screening results and addresses of 485,000 women from a lab","paraphrase":"A lab running part of a national screening programme confirmed it was hacked. Test results, names, addresses, provider names and GP referrals of about 485,000 women, going back years, were stolen. The screening organisation said several years were involved.","source":"NOS","url":"https://nos.nl/artikel/2578296-gegevens-honderdduizenden-vrouwen-gehackt-bij-bevolkingsonderzoek-baarmoederhalskanker","archiveUrl":"https://web.archive.org/web/20261005204706/https://nos.nl/artikel/2578296-gegevens-honderdduizenden-vrouwen-gehackt-bij-bevolkingsonderzoek-baarmoederhalskanker","theme":"breach","status":"admitted","id":"NLD-S004","pageUrl":"https://healthrecordrights.com/real-cases/#NLD-S004","countryUrl":"https://healthrecordrights.com/brief/netherlands/","why":"A national screening programme sends results through one lab; one breach there exposes hundreds of thousands.","sourceType":"journalism","lang":"nl","providerName":"Clinical Diagnostics","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NLD","country":"Netherlands","date":"2025-09-11","headline":"One in ten hospital patients hit a near miss because records were missing","paraphrase":"A patient survey found more than one in ten people treated in hospital in 2024 experienced something going, or nearly going, wrong because a provider lacked their medical information. Reported harms included repeat scans and medication errors.","source":"ICT&health","url":"https://www.icthealth.nl/nieuws/patientenfederatie-nationale-aanpak-gebrekkige-gegevensuitwisseling","archiveUrl":"https://web.archive.org/web/20261005204734/https://www.icthealth.nl/nieuws/patientenfederatie-nationale-aanpak-gebrekkige-gegevensuitwisseling","theme":"lost_between_providers","status":"self_reported","id":"NLD-S005","pageUrl":"https://healthrecordrights.com/real-cases/#NLD-S005","countryUrl":"https://healthrecordrights.com/brief/netherlands/","why":"When one provider cannot see what another recorded, patients face repeat scans, wrong medicines and wrong diagnoses.","sourceType":"journalism","lang":"nl","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NLD","country":"Netherlands","date":"2026-04-20","headline":"Software supplier admits hackers stole patient records from several Dutch care providers","paraphrase":"A maker of electronic patient record software confirmed that ransomware attackers stole patients' personal data, including medical records, from several Dutch healthcare institutions. It first said theft was unlikely. Sixty-six institutions reported a breach to the data protection authority.","source":"Cybernews","url":"https://cybernews.com/cybercrime/healthcare-tech-giant-chipsoft-patient-data-stolen/","theme":"breach","status":"admitted","id":"NLD-S006","pageUrl":"https://healthrecordrights.com/real-cases/#NLD-S006","countryUrl":"https://healthrecordrights.com/brief/netherlands/","why":"A single supplier's breach can expose the medical records of patients at many care providers at once.","sourceType":"journalism","lang":"en","providerName":"ChipSoft","lastVerified":"2026-10-04","addedOn":"2026-10-04","inLanguage":"en"},{"iso3":"NZL","country":"New Zealand","date":"2025-06-16","headline":"Agency mailed a person's health information to the wrong house","paraphrase":"A government agency sent a person's health information to the wrong address because a staff member recorded the house number incorrectly. The agency at first denied a mistake; after the regulator stepped in, it apologised and agreed to pay compensation.","source":"Office of the Privacy Commissioner (New Zealand), Case Note 329225 [2025] NZ Priv Cmr 1","url":"https://www.privacy.org.nz/resources-and-learning/case-notes-and-court-decisions/case-note-329225-2025-nz-priv-cmr-1-individual-complains-that-government-agency-sent-their-health-information-to-an-incorrect-address/","theme":"breach","status":"admitted","id":"NZL-S001","pageUrl":"https://healthrecordrights.com/real-cases/#NZL-S001","countryUrl":"https://healthrecordrights.com/brief/new-zealand/","why":"A wrong address in a file can expose health details; this person needed the regulator's help to be heard.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NZL","country":"New Zealand","date":"2026-09-23","headline":"Portal and Health NZ ordered to fix security after 99,416 patients' data exposed","paraphrase":"After a cyberattack exposed health documents belonging to 99,416 people, a review found gaps in protection, weak oversight of tech suppliers and late notice to those affected. The portal operator and Health NZ were ordered to strengthen safeguards.","source":"Stuff","url":"https://www.stuff.co.nz/nz-news/361037084/nearly-100000-patients-had-health-data-exposed-now-two-agencies-have-been-ordered-fix-security","theme":"breach","status":"finding","id":"NZL-S002","pageUrl":"https://healthrecordrights.com/real-cases/#NZL-S002","countryUrl":"https://healthrecordrights.com/brief/new-zealand/","why":"Hospital records sent to patients through a private portal were stolen; both holders were found at fault.","sourceType":"journalism","lang":"en","providerName":"Manage My Health; Health New Zealand","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NZL","country":"New Zealand","date":"2026-01-09","headline":"Patients told their health records were stolen could not get answers","paraphrase":"After a ransomware attack on a patient portal, a woman told her records were affected could not log in, and the helpline cut her off. Another was told both that her data was and was not affected.","source":"RNZ","url":"https://www.rnz.co.nz/news/business/583637/manage-my-health-patients-draw-blanks-in-quest-for-information-on-cybersecurity-breach","theme":"breach","status":"admitted","id":"NZL-S003","pageUrl":"https://healthrecordrights.com/real-cases/#NZL-S003","countryUrl":"https://healthrecordrights.com/brief/new-zealand/","why":"After a breach, people need to know what was taken; crashed sites and cut-off helplines left them guessing.","sourceType":"journalism","lang":"en","providerName":"Manage My Health","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NZL","country":"New Zealand","date":"2026-03-29","headline":"Health NZ says two people can be wrongly linked to one patient number","paraphrase":"Health NZ acknowledged that two people with near-identical details can be linked to one National Health Index number, and that some may have received the wrong care as a result. It said it keeps no central record of such cases.","source":"RNZ","url":"https://www.rnz.co.nz/news/health/590930/concerns-patients-receiving-incorrect-treatment-due-to-mistaken-identity","theme":"record_wrong","status":"admitted","id":"NZL-S004","pageUrl":"https://healthrecordrights.com/real-cases/#NZL-S004","countryUrl":"https://healthrecordrights.com/brief/new-zealand/","why":"When two people share one health identifier, one person's record can guide another person's care.","sourceType":"journalism","lang":"en","providerName":"Health New Zealand","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NZL","country":"New Zealand","date":"2026-02-25","headline":"Health worker used a colleague's login to open two people's records","paraphrase":"An audit two patients requested showed a health worker they knew had opened both their medical records, over a personal matter, using a colleague's login. She lost her job, and a court found her guilty.","source":"RNZ","url":"https://www.rnz.co.nz/news/regions_wellington/587931/health-worker-guilty-of-illegally-accessing-ex-partner-s-medical-records","theme":"breach","status":"finding","id":"NZL-S005","pageUrl":"https://healthrecordrights.com/real-cases/#NZL-S005","countryUrl":"https://healthrecordrights.com/brief/new-zealand/","why":"Staff can misuse record systems in personal disputes; an audit requested by the patients exposed it.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NIC","country":"Nicaragua","date":"2026-06-04","headline":"Officials disclosed a person's health history at a press conference, experts say","paraphrase":"Officials discussed a person's health history and private life at a press conference. Specialists interviewed said this breached confidentiality standards for health information.","source":"Divergentes","url":"https://www.divergentes.com/crisis-salud-mental-espectaculo-nicaragua/","theme":"sold_or_shared","status":"alleged","id":"NIC-S001","pageUrl":"https://healthrecordrights.com/real-cases/#NIC-S001","countryUrl":"https://healthrecordrights.com/brief/nicaragua/","why":"When the state broadcasts what belongs in a confidential file, patients learn that seeking care can mean public exposure.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NIC","country":"Nicaragua","date":"2026-04-22","headline":"Patient told her hospital file could not be found and had to repeat tests","paraphrase":"A woman says two appointments were cancelled for lack of doctors, then staff said they could not locate her file. She repeated her tests and waited more than a year for follow-up.","source":"Divergentes","url":"https://www.divergentes.com/nicaragua-menos-medicos-centroamerica-atencion-salud/","theme":"access_delay_or_cost","status":"alleged","id":"NIC-S002","pageUrl":"https://healthrecordrights.com/real-cases/#NIC-S002","countryUrl":"https://healthrecordrights.com/brief/nicaragua/","why":"A lost file means repeated tests and months of waiting before anyone acts on the results.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NIC","country":"Nicaragua","date":"2026-01-20","headline":"Photos of patients during medical exams appeared in official propaganda posts","paraphrase":"The outlet reports that a public hospital published photos of patients undergoing scans, some partly undressed and recognisable, in political messaging. Lawyers and health workers say this breaks the health law's confidentiality rules; no explanation was given.","source":"Darío Medios","url":"https://dariomedios.com/minsa-expone-a-pacientes-en-propaganda-oficial-y-viola-la-ley-general-de-salud","archiveUrl":"https://web.archive.org/web/20261005204449/https://dariomedios.com/minsa-expone-a-pacientes-en-propaganda-oficial-y-viola-la-ley-general-de-salud","theme":"sold_or_shared","status":"alleged","id":"NIC-S003","pageUrl":"https://healthrecordrights.com/real-cases/#NIC-S003","countryUrl":"https://healthrecordrights.com/brief/nicaragua/","why":"Images taken during care are part of a patient's confidential information and should never be published without consent.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NIC","country":"Nicaragua","date":"2025-08-01","headline":"Insured patients moved after clinic seizure to doctors who lacked their histories","paraphrase":"After authorities shut a private clinic network serving social security members, an inside source says surgeries were cancelled and patients were left with doctors who did not know their medical histories. Members were redirected elsewhere.","source":"Darío Medios","url":"https://dariomedios.com/regimen-sandinista-confisca-amocsa-y-traslada-asegurados-al-cuestionado-sistema-sermesa","archiveUrl":"https://web.archive.org/web/20261005204508/https://dariomedios.com/regimen-sandinista-confisca-amocsa-y-traslada-asegurados-al-cuestionado-sistema-sermesa","theme":"lost_between_providers","status":"alleged","id":"NIC-S004","pageUrl":"https://healthrecordrights.com/real-cases/#NIC-S004","countryUrl":"https://healthrecordrights.com/brief/nicaragua/","why":"When a provider closes overnight, patients' histories must follow them or the next doctor starts blind.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NGA","country":"Nigeria","date":"2025-01-18","headline":"Patient paid repeatedly for the same tests because records did not follow her","paraphrase":"A patient told reporters that each new hospital, private then public, made her repeat and pay for routine tests she had already done, because results were not transferable. A records officer said each hospital keeps its own unlinked system.","source":"Sahara Reporters (republishing a Daily Trust report)","url":"https://saharareporters.com/2025/01/18/non-harmonisation-health-records-nigerian-hospitals-slows-down-patients-during-medical","theme":"lost_between_providers","status":"self_reported","id":"NGA-S001","pageUrl":"https://healthrecordrights.com/real-cases/#NGA-S001","countryUrl":"https://healthrecordrights.com/brief/nigeria/","why":"When hospitals cannot share records, patients pay again for tests they already had.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"NGA","country":"Nigeria","date":"2026-07-23","headline":"Teaching hospital says patient case files are still carried by hand during digitisation","paraphrase":"Responding to reports of consultation delays and piles of paper folders, the hospital's chief medical director said electronic records cover only two departments so far and the rest will follow in phases.","source":"Punch","url":"https://punchng.com/lasuth-defends-digitalisation-over-patient-record-concerns/","archiveUrl":"https://web.archive.org/web/20261005204354/https://punchng.com/lasuth-defends-digitalisation-over-patient-record-concerns/","theme":"access_delay_or_cost","status":"admitted","id":"NGA-S002","pageUrl":"https://healthrecordrights.com/real-cases/#NGA-S002","countryUrl":"https://healthrecordrights.com/brief/nigeria/","why":"Paper folders moved by hand slow consultations and can go missing between departments.","sourceType":"journalism","lang":"en","providerName":"Lagos State University Teaching Hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"PRK","country":"North Korea","date":"2025-04-07","headline":"North Korean hospitals post a fee for diagnosis certificates as free care fades","paraphrase":"Residents told a news outlet that hospitals now post charges at reception, including a fee for a diagnosis certificate, so patients must pay to get a written record of their own diagnosis.","source":"Radio Free Asia (Korean service)","url":"https://www.rfa.org/korean/in-focus/2025/04/07/north-korea-hospital-treatment-cost/","theme":"access_delay_or_cost","status":"alleged","id":"PRK-S001","pageUrl":"https://healthrecordrights.com/real-cases/#PRK-S001","countryUrl":"https://healthrecordrights.com/brief/north-korea/","why":"Patients reportedly now pay a posted fee just to get a written record of their own diagnosis.","sourceType":"journalism","lang":"ko","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"MKD","country":"North Macedonia","date":"2026-07-29","headline":"Hospital fined after another person's health details were put in a patient's record","paraphrase":"A referral was issued in a patient's name on a day she received no care, carrying someone else's health data. Further referrals and reports followed. The regulator fined the hospital, its director and the doctor; a court upheld it.","source":"Агенција за заштита на личните податоци (AZLP), North Macedonia","url":"https://azlp.mk/%d1%83%d0%bf%d1%80%d0%b0%d0%b2%d0%bd%d0%b8%d0%be%d1%82-%d1%81%d1%83%d0%b4-%d1%98%d0%b0-%d0%bf%d0%be%d1%82%d0%b2%d1%80%d0%b4%d0%b8-%d0%be%d0%b4%d0%bb%d1%83%d0%ba%d0%b0%d1%82%d0%b0-%d0%b7%d0%b0-%d0%b8/","archiveUrl":"https://web.archive.org/web/20261005203139/https://azlp.mk/%d1%83%d0%bf%d1%80%d0%b0%d0%b2%d0%bd%d0%b8%d0%be%d1%82-%d1%81%d1%83%d0%b4-%d1%98%d0%b0-%d0%bf%d0%be%d1%82%d0%b2%d1%80%d0%b4%d0%b8-%d0%be%d0%b4%d0%bb%d1%83%d0%ba%d0%b0%d1%82%d0%b0-%d0%b7%d0%b0-%d0%b8/","theme":"record_wrong","status":"finding","id":"MKD-S001","pageUrl":"https://healthrecordrights.com/real-cases/#MKD-S001","countryUrl":"https://healthrecordrights.com/brief/north-macedonia/","why":"One wrong entry in the national e-health system spread into further referrals and reports under a patient's name.","sourceType":"regulator_decision","lang":"mk","providerName":"ЈЗУ Универзитетска клиника за гастроентерохепатологија – Скопје","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MKD","country":"North Macedonia","date":"2025-05-07","headline":"Patient refused care after a clinician read their electronic health record","paraphrase":"A patient seeking urgent treatment saw a clinician who looked in the national electronic record, learned of a sensitive entry and refused even a basic exam. The patient has sued for discrimination; advocates say any doctor can see everything.","source":"Призма (BIRN North Macedonia)","url":"https://prizma.mk/dijagnoza-na-tsel-glas-koga-se-krshi-privatnosta-na-patsientite/","archiveUrl":"https://web.archive.org/web/20261005203203/https://prizma.mk/dijagnoza-na-tsel-glas-koga-se-krshi-privatnosta-na-patsientite/","theme":"sold_or_shared","status":"alleged","id":"MKD-S002","pageUrl":"https://healthrecordrights.com/real-cases/#MKD-S002","countryUrl":"https://healthrecordrights.com/brief/north-macedonia/","why":"When any doctor can open the whole record, sensitive entries can be used to turn a patient away.","sourceType":"journalism","lang":"mk","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"MKD","country":"North Macedonia","date":"2026-04-01","headline":"Regulator finds public health body unprepared when ransomware locked patient data","paraphrase":"A ransomware attack encrypted personal data held by a public health institution. On inspection the data protection regulator found the institution lacked proper technical and organisational safeguards and was poorly prepared to handle security incidents.","source":"Агенција за заштита на личните податоци (AZLP), Annual Report 2025","url":"https://azlp.mk/wp-content/uploads/2026/04/AZLP-Godisen-izvestaj-2025-%D0%9C%D0%9A.pdf","archiveUrl":"https://web.archive.org/web/20261005203224/https://azlp.mk/wp-content/uploads/2026/04/AZLP-Godisen-izvestaj-2025-%D0%9C%D0%9A.pdf","theme":"breach","status":"finding","id":"MKD-S003","pageUrl":"https://healthrecordrights.com/real-cases/#MKD-S003","countryUrl":"https://healthrecordrights.com/brief/north-macedonia/","why":"Patients' records became unavailable and exposed to risk because basic security measures were missing.","sourceType":"regulator_decision","lang":"mk","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NOR","country":"Norway","date":"2025-06-11","headline":"Doctors warn records moved to new system arrive with missing documents and wrong dates","paraphrase":"Doctors said moving 25 years of patient records into a new system produced missing documents, absent operation notes and wrong dates. The regional health authority confirmed only about half of 200 million documents had been moved.","source":"NRK","url":"https://www.nrk.no/mr/legar-i-midt-noreg-fryktar-overforing-av-data-til-helseplattforma-trugar-pasient-tryggleiken-1.17437171","archiveUrl":"https://web.archive.org/web/20261005204902/https://www.nrk.no/mr/legar-i-midt-noreg-fryktar-overforing-av-data-til-helseplattforma-trugar-pasient-tryggleiken-1.17437171","theme":"record_wrong","status":"admitted","id":"NOR-S002","pageUrl":"https://healthrecordrights.com/real-cases/#NOR-S002","countryUrl":"https://healthrecordrights.com/brief/norway/","why":"Decades of history moved between systems can arrive incomplete or wrong, and clinicians may rely on it.","sourceType":"journalism","lang":"no","providerName":"Helse Midt-Norge","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NOR","country":"Norway","date":"2025-06-16","headline":"System change missed messages from outside hospitals in thousands of patient cases","paraphrase":"A record-system change made in 2023 failed to flag certain messages about discharge reports from other hospitals and specialists. Hospitals identified 3,445 cases needing review. The hospital said an early check found some needed follow-up.","source":"VG","url":"https://www.vg.no/nyheter/i/kw9yaX/to-aar-gammel-endring-i-helseplattformen-kan-ha-rammet-pasienter","archiveUrl":"https://web.archive.org/web/20261005204927/https://www.vg.no/nyheter/i/kw9yaX/to-aar-gammel-endring-i-helseplattformen-kan-ha-rammet-pasienter","theme":"lost_between_providers","status":"admitted","id":"NOR-S003","pageUrl":"https://healthrecordrights.com/real-cases/#NOR-S003","countryUrl":"https://healthrecordrights.com/brief/norway/","why":"Letters from other hospitals can fail to reach the team that must act on them, for years, unnoticed.","sourceType":"journalism","lang":"no","providerName":"St. Olavs hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NOR","country":"Norway","date":"2025-09-10","headline":"Municipal employee read patient records without reason for about 15 years","paraphrase":"A random audit found an employee had looked into municipal care records without a work reason for around 15 years, affecting about 2,100 residents. The municipality reported it to police and said it saw no sign of onward sharing.","source":"NRK","url":"https://www.nrk.no/nordland/vefsn-kommune_-ansatt-snek-i-pasientjournaler-i-15-ar-1.17565826","archiveUrl":"https://web.archive.org/web/20261005204946/https://www.nrk.no/nordland/vefsn-kommune_-ansatt-snek-i-pasientjournaler-i-15-ar-1.17565826","theme":"breach","status":"admitted","id":"NOR-S004","pageUrl":"https://healthrecordrights.com/real-cases/#NOR-S004","countryUrl":"https://healthrecordrights.com/brief/norway/","why":"An old record system gave no warning of improper lookups, so snooping went on for years before a spot check.","sourceType":"journalism","lang":"no","providerName":"Vefsn kommune","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NOR","country":"Norway","date":"2026-04-15","headline":"Patient spotted repeated snooping in their own access log; regulator found breaches","paraphrase":"A patient saw in the national health portal that a hospital worker had opened their record on several dates without reason. The county governor found clear breaches of confidentiality but closed the case without sanction.","source":"NRK","url":"https://www.nrk.no/sorlandet/sykehusansatt-snoket-i-pasientjournal---slipper-straff-1.17846230","archiveUrl":"https://web.archive.org/web/20261005205020/https://www.nrk.no/sorlandet/sykehusansatt-snoket-i-pasientjournal---slipper-straff-1.17846230","theme":"breach","status":"finding","id":"NOR-S005","pageUrl":"https://healthrecordrights.com/real-cases/#NOR-S005","countryUrl":"https://healthrecordrights.com/brief/norway/","why":"Patients can see who opened their record online; that log is how this breach came to light.","sourceType":"journalism","lang":"no","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"NOR","country":"Norway","date":"2025-12-02","headline":"Regulator finds significant privacy failings in a regional patient record system","paraphrase":"After complaints and breach reports, the data protection authority inspected the record system used by hospitals and municipalities in central Norway. It found significant deficiencies, privacy breaches and unclear responsibilities, and gave notice of a correction order.","source":"Dagens Medisin (NTB)","url":"https://www.dagensmedisin.no/datatilsynet-e-helse-helse-midt-norge-rhf/datatilsynet-kritiserer-helseplattformen-etter-tilsyn-varsler-palegg-om-retting/720948","theme":"other","status":"finding","id":"NOR-S006","pageUrl":"https://healthrecordrights.com/real-cases/#NOR-S006","countryUrl":"https://healthrecordrights.com/brief/norway/","why":"When nobody is clearly responsible for a shared record system, errors in patients' data go unfixed.","sourceType":"journalism","lang":"no","providerName":"Helseplattformen AS","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PAK","country":"Pakistan","date":"2026-03-29","headline":"Health department disciplines hospital staff after patients were filmed during care","paraphrase":"Staff recorded patients during procedures and the video spread online. The provincial health department, which runs the hospital, suspended senior staff and said the recording breached medical ethics and undermined patient privacy.","source":"The News International","url":"https://www.thenews.pk/story/1407037-five-lahore-doctors-postgraduate-training-terminated-over-ethical-breach","theme":"breach","status":"admitted","id":"PAK-S001","pageUrl":"https://healthrecordrights.com/real-cases/#PAK-S001","countryUrl":"https://healthrecordrights.com/brief/pakistan/","why":"Footage of patients in care is clinical information; once shared online it cannot be recalled.","sourceType":"journalism","lang":"en","providerName":"Lady Willingdon Hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PAK","country":"Pakistan","date":"2026-06-30","headline":"Families say hospitals withhold clinical summaries needed to move patients elsewhere","paraphrase":"Attendants told the newspaper that public, private and charitable hospitals often refuse a short clinical summary while treatment continues, saying it comes only after formal discharge, leaving families unable to arrange transfers or second opinions.","source":"The News International","url":"https://www.thenews.pk/print/1423136-hospital-transfers-continue-to-be-ordeal-for-families-of-critical-patients","theme":"lost_between_providers","status":"alleged","id":"PAK-S002","pageUrl":"https://healthrecordrights.com/real-cases/#PAK-S002","countryUrl":"https://healthrecordrights.com/brief/pakistan/","why":"Without a summary of their care, patients cannot get a second opinion or be admitted by another hospital.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PAK","country":"Pakistan","date":"2026-09-01","headline":"Police refer case of allegedly false medical reports to Sindh health regulator","paraphrase":"Police finished an inquiry into medical reports allegedly faked to justify a procedure on a woman at a private hospital in Sindh. The provincial healthcare commission will have experts review all records and hear both sides.","source":"The Express Tribune","url":"https://tribune.com.pk/story/2626839/fake-pregnancy-real-c-section-hospital-case-lands-before-shcc","theme":"record_wrong","status":"alleged","id":"PAK-S003","pageUrl":"https://healthrecordrights.com/real-cases/#PAK-S003","countryUrl":"https://healthrecordrights.com/brief/pakistan/","why":"When reports in a patient's file are false, decisions about their care rest on a record nobody can trust.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PLW","country":"Palau","date":"2025-03-06","headline":"Palau health ministry says ransomware attack exposed hospital patient records","paraphrase":"The health ministry said attackers accessed hospital patient data, including names, addresses, phone numbers, birth dates and medical details. It advised everyone in Palau to watch for fraud and phishing messages.","source":"teiss","url":"https://www.teiss.co.uk/news/ransomware-attack-on-palaus-health-ministry-compromised-citizens-medical-records-15450","theme":"breach","status":"admitted","id":"PLW-S001","pageUrl":"https://healthrecordrights.com/real-cases/#PLW-S001","countryUrl":"https://healthrecordrights.com/brief/palau/","why":"Names, addresses, birth dates and medical details of patients were taken, raising fraud and phishing risks.","sourceType":"journalism","lang":"en","providerName":"Ministry of Health and Human Services","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PLW","country":"Palau","date":"2025-02-21","headline":"Cyberattack forced Palau hospital staff to pull patient records by hand","paraphrase":"After a ransomware attack the ministry shut its systems, and staff retrieved patient records manually. Services were delayed, and patients were asked to bring medicine containers and written prescriptions for refills.","source":"Island Times","url":"https://islandtimes.org/cyberattacks-on-the-rise-in-palau-whipps-stresses-need-for-stronger-recovery-systems/","theme":"access_delay_or_cost","status":"admitted","id":"PLW-S002","pageUrl":"https://healthrecordrights.com/real-cases/#PLW-S002","countryUrl":"https://healthrecordrights.com/brief/palau/","why":"When the record system went down, patients faced delays and had to bring their own prescriptions.","sourceType":"journalism","lang":"en","providerName":"Ministry of Health and Human Services","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PSE","country":"Palestine","date":"2025-11-11","headline":"Gaza officials say over 70% of three hospitals' medical archives were damaged or lost","paraphrase":"Gaza's director general of hospitals said over 70% of the medical archive at three hospitals was damaged or lost in the war. A ministry spokesman said staff cannot trace thousands of injured people's medical histories without the records.","source":"Al-Quds Al-Arabi","url":"https://www.alquds.co.uk/%D9%83%D9%8A%D9%81-%D8%AF%D9%85%D8%B1-%D8%A7%D9%84%D8%A7%D8%AD%D8%AA%D9%84%D8%A7%D9%84-%D8%A7%D9%84%D8%A5%D8%B3%D8%B1%D8%A7%D8%A6%D9%8A%D9%84%D9%8A-%D8%A7%D9%84%D8%A3%D8%B1%D8%B4%D9%8A%D9%81-%D8%A7/","theme":"other","status":"admitted","id":"PSE-S001","pageUrl":"https://healthrecordrights.com/real-cases/#PSE-S001","countryUrl":"https://healthrecordrights.com/brief/palestine/","why":"Patients treated in Gaza may have no surviving record of past care to show new doctors.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-02","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PAN","country":"Panama","date":"2026-04-17","headline":"Newspaper finds insured people's medical histories and signatures posted online after a hack","paraphrase":"Reporters said they could search and download insured people's medical histories, signatures and phone numbers from a site run by hackers who offered the data for sale. Security experts said they had warned the institution for weeks.","source":"La Estrella de Panamá","url":"https://www.laestrella.com.pa/panama/nacional/hackeo-masivo-en-la-css-expone-nombres-firmas-e-historial-medico-de-asegurados-PC21679565","theme":"breach","status":"alleged","id":"PAN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#PAN-S001","countryUrl":"https://healthrecordrights.com/brief/panama/","why":"Medical histories and X-rays of thousands of insured people were reported freely searchable online, with little word to those affected.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PRY","country":"Paraguay","date":"2026-06-11","headline":"Health regulator finds a patient's digital record was rewritten minutes after the event","paraphrase":"An audit by the Superintendencia de Salud found that the original entry in a patient's digital clinical record at the social security hospital was deleted and replaced six minutes later with a different account. The regulator identified the user responsible.","source":"ABC Color","url":"https://www.abc.com.py/nacionales/2026/06/11/negligencia-en-ips-ingavi-borraron-evidencias-tras-cirugia-erronea-confirma-superintendencia-de-salud/","theme":"record_wrong","status":"finding","id":"PRY-S001","pageUrl":"https://healthrecordrights.com/real-cases/#PRY-S001","countryUrl":"https://healthrecordrights.com/brief/paraguay/","why":"A record that staff can quietly overwrite cannot protect the patient when something goes wrong.","sourceType":"journalism","lang":"es","providerName":"Instituto de Previsión Social (IPS)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PRY","country":"Paraguay","date":"2025-06-23","headline":"Government cyber team confirms attack on Ministry of Health systems","paraphrase":"The national incident response team CERT-PY said a cyber incident hit the Ministry of Health and was contained. A security expert warned that data taken in such attacks usually ends up exposed on dark web forums.","source":"ABC Color","url":"https://www.abc.com.py/politica/2025/06/23/hackean-ahora-datos-de-salud-publica-y-jem-admite-mitic/","theme":"breach","status":"admitted","id":"PRY-S002","pageUrl":"https://healthrecordrights.com/real-cases/#PRY-S002","countryUrl":"https://healthrecordrights.com/brief/paraguay/","why":"The ministry runs the national health information system; a breach there can reach many patients' data.","sourceType":"journalism","lang":"es","providerName":"Ministerio de Salud Pública y Bienestar Social","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PRY","country":"Paraguay","date":"2026-06-26","headline":"Ransomware locks electronic clinical records at several private hospitals","paraphrase":"A reported ransomware attack on a private hospital group encrypted electronic clinical records and booking systems, forcing staff back to paper and delaying admissions, tests and appointments while attackers reportedly demanded payment.","source":"El Nacional","url":"https://elnacional.com.py/politica/ciberataque-paraliza-sistemas-importantes-sanatorios-privados-obliga-operar-forma-manual-n108107","theme":"breach","status":"alleged","id":"PRY-S003","pageUrl":"https://healthrecordrights.com/real-cases/#PRY-S003","countryUrl":"https://healthrecordrights.com/brief/paraguay/","why":"When records are encrypted by attackers, patients face delays and their data may be in criminal hands.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PER","country":"Peru","date":"2026-08-27","headline":"Regulator fines clinic for sending a patient's full record to prosecutors without consent","paraphrase":"A clinic emailed a patient's complete record, covering about fifteen years, to prosecutors without her consent, her representative's approval or a court order. The national health regulator found this broke health law and fined the clinic.","source":"La República","url":"https://larepublica.pe/politica/2026/08/26/nadine-heredia-susalud-sanciona-a-clinica-delgado-por-entregar-historial-clinico-de-exprimera-dama-sin-autorizacion-a-fiscalia-hnews-499746","theme":"sold_or_shared","status":"finding","id":"PER-S001","pageUrl":"https://healthrecordrights.com/real-cases/#PER-S001","countryUrl":"https://healthrecordrights.com/brief/peru/","why":"Peru's health regulator says a prosecutor's letter alone does not let a clinic hand over a patient's record.","sourceType":"journalism","lang":"es","providerName":"Clínica Delgado (Medic Ser S.A.C., grupo Auna)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PER","country":"Peru","date":"2025-07-03","headline":"Clinic fined after staff leaked an image of a patient's record online","paraphrase":"A photo of a computer screen showing a hospitalised patient's record spread online. The national health regulator ruled the disclosure a grave breach of confidentiality and fined the clinic more than 668,000 soles; the clinic said it would appeal.","source":"RPP Noticias","url":"https://rpp.pe/economia/economia/te-aviso-te-anuncio-susalud-multa-a-clinica-delgado-por-filtrar-informacion-medica-de-shakira-noticia-1644481","theme":"breach","status":"finding","id":"PER-S002","pageUrl":"https://healthrecordrights.com/real-cases/#PER-S002","countryUrl":"https://healthrecordrights.com/brief/peru/","why":"One of Peru's largest record-confidentiality fines; the regulator treats any leak of patient data as a grave offence.","sourceType":"journalism","lang":"es","providerName":"Clínica Delgado (grupo Auna)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PER","country":"Peru","date":"2026-05-29","headline":"Social security health service opens audit after a patient's record reached television","paraphrase":"Details from a patient's record were broadcast on a television programme. The public health insurer issued a statement rejecting the leak and opened an internal audit to identify the people who breached its system and supplied the information.","source":"La República","url":"https://larepublica.pe/politica/2026/05/29/pedro-castillo-essalud-inicia-auditoria-por-filtracion-de-historia-clinica-del-expresidente-hnews-877540","theme":"breach","status":"admitted","id":"PER-S003","pageUrl":"https://healthrecordrights.com/real-cases/#PER-S003","countryUrl":"https://healthrecordrights.com/brief/peru/","why":"The public insurer covering millions confirmed that someone inside its system passed on a patient's record.","sourceType":"journalism","lang":"es","providerName":"EsSalud","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PER","country":"Peru","date":"2025-09-28","headline":"Investigation finds clinics and insurers using patients' health data without consent","paraphrase":"Reporters found private clinics and health insurers collecting sensitive health and personal data without consent and using it beyond care. Misuse led to one patient's suspension from work and to marketing harassment; regulators fined the sector over four million soles.","source":"OjoPúblico","url":"https://ojo-publico.com/5923/clinicas-y-aseguradoras-recogen-datos-sin-consentimiento-pacientes","theme":"sold_or_shared","status":"alleged","id":"PER-S004","pageUrl":"https://healthrecordrights.com/real-cases/#PER-S004","countryUrl":"https://healthrecordrights.com/brief/peru/","why":"Health data gathered for care was reused for other purposes, costing one patient time off work.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PHL","country":"Philippines","date":"2026-09-12","headline":"Ransomware group claims it stole millions of files from a private hospital","paraphrase":"A ransomware group said it took about 2.44 terabytes of hospital data, including patient records and scans, and demanded payment. The hospital in Mindanao said its first checks found no sign of a breach and it was still investigating.","source":"The Mindanao Sentinel","url":"https://themindanaosentinel.com/2026/09/rhysida-claims-2-44-tb-data-theft-from-general-santos-doctors-hospital-gsdh-says-no-breach-confirmed/","theme":"breach","status":"alleged","id":"PHL-S001","pageUrl":"https://healthrecordrights.com/real-cases/#PHL-S001","countryUrl":"https://healthrecordrights.com/brief/philippines/","why":"A single hospital network holds scans, insurance numbers and admission records for many patients.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PHL","country":"Philippines","date":"2025-12-09","headline":"Insurer finds about 1,000 paid claims for patients who were never treated","paraphrase":"The national health insurer said it was investigating about 1,000 suspected ghost patient claims in the Cordillera region, where members were recorded as treated when they were not. Members spotted them after receiving text alerts.","source":"Philstar.com","url":"https://www.philstar.com/nation/2025/12/09/2492899/philhealth-probes-ghost-patients-car","theme":"record_wrong","status":"alleged","id":"PHL-S002","pageUrl":"https://healthrecordrights.com/real-cases/#PHL-S002","countryUrl":"https://healthrecordrights.com/brief/philippines/","why":"False entries in a member's insurance record can go unnoticed unless the patient is told.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"POL","country":"Poland","date":"2026-06-24","headline":"Court backs ombudsman: closed clinic's records must still be released to patients","paraphrase":"After a medical practice closed, the former partner holding its records stopped releasing them to patients during a dispute with the other partner. The ombudsman ordered the practice to stop, and an administrative court rejected the appeal.","source":"Rzecznik Praw Pacjenta (Patient Rights Ombudsman)","url":"https://www.gov.pl/web/rpp/sad-potwierdzil-obowiazek-udostepniania-dokumentacji-medycznej-po-zakonczeniu-dzialalnosci-podmiotu-leczniczego","theme":"lost_between_providers","status":"finding","id":"POL-S001","pageUrl":"https://healthrecordrights.com/real-cases/#POL-S001","countryUrl":"https://healthrecordrights.com/brief/poland/","why":"When a practice closes, patients can lose their records in disputes between former owners.","sourceType":"regulator_decision","lang":"pl","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"POL","country":"Poland","date":"2025-09-02","headline":"Doctor reprimanded for leaving patient cards readable in a parked car","paraphrase":"A patient saw patient record cards in a clear box on the front seat of a doctor's parked car, with one card's name, address, birth date and ID number readable. The regulator reprimanded the doctor and ordered the patient notified.","source":"Urząd Ochrony Danych Osobowych (UODO)","url":"https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2025:dkn_5131_6/content","theme":"breach","status":"finding","id":"POL-S002","pageUrl":"https://healthrecordrights.com/real-cases/#POL-S002","countryUrl":"https://healthrecordrights.com/brief/poland/","why":"Paper records left in plain view exposed patients' names, addresses and ID numbers to passers-by.","sourceType":"regulator_decision","lang":"pl","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"POL","country":"Poland","date":"2024-12-16","headline":"Hospital fined after a patient was handed another person's medical records","paraphrase":"A patient received someone else's medical records, including name, birth date, national ID number and health data. The hospital did not report the breach or tell the affected person in time. The regulator fined it 29,648 zloty.","source":"Urząd Ochrony Danych Osobowych (UODO)","url":"https://uodo.gov.pl/pl/138/3475","theme":"breach","status":"finding","id":"POL-S003","pageUrl":"https://healthrecordrights.com/real-cases/#POL-S003","countryUrl":"https://healthrecordrights.com/brief/poland/","why":"A mix-up put one patient's identity and health details in a stranger's hands, and no one reported it in time.","sourceType":"regulator_decision","lang":"pl","providerName":"Szpital Powiatowy we Wrześni","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"POL","country":"Poland","date":"2026-09-25","headline":"Clinic software flaw exposed patient ID numbers and hospital discharge papers","paraphrase":"Attackers used a flaw in practice software used by hundreds of clinics to take names, national ID numbers, contacts and discharge documents. It went unnoticed for over two weeks. The vendor said it fixed the flaw and forced password changes.","source":"Wprost","url":"https://biznes.wprost.pl/innowacje/12452412/tym-razem-medyc-znow-doszlo-do-poteznego-wycieku-danych-medycznych-polakow.html","theme":"breach","status":"admitted","id":"POL-S004","pageUrl":"https://healthrecordrights.com/real-cases/#POL-S004","countryUrl":"https://healthrecordrights.com/brief/poland/","why":"One vendor's flaw can expose records from hundreds of clinics at once, and patients learn weeks later.","sourceType":"journalism","lang":"pl","providerName":"Qbusoft (Medyc software)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"POL","country":"Poland","date":"2025-05-09","headline":"National patient portal flaw let a user open other people's medical documents","paraphrase":"A user found that changing a web address in the national patient account showed other patients' documents, with names, national ID numbers, ID card numbers and health data. The ministry confirmed the flaw but would not name the facility.","source":"CyberDefence24","url":"https://cyberdefence24.pl/cyberbezpieczenstwo/blad-w-ikp-mozna-bylo-uzyskac-dokumentacje-pacjentow","theme":"breach","status":"admitted","id":"POL-S005","pageUrl":"https://healthrecordrights.com/real-cases/#POL-S005","countryUrl":"https://healthrecordrights.com/brief/poland/","why":"Patients cannot tell if their records were exposed when the affected facility is not named.","sourceType":"journalism","lang":"pl","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PRT","country":"Portugal","date":"2026-07-29","headline":"Hospital admitted staff outside the care team opened a patient's record","paraphrase":"A family member with power of attorney obtained the record's access log and found entries by staff outside the care team. The hospital admitted improper access but withheld names; the commission said the names must be given.","source":"Comissão de Acesso aos Documentos Administrativos (CADA), Parecer 392/2026","url":"https://www.cada.pt/files/pareceres/2026/392.pdf","theme":"breach","status":"finding","id":"PRT-S001","pageUrl":"https://healthrecordrights.com/real-cases/#PRT-S001","countryUrl":"https://healthrecordrights.com/brief/portugal/","why":"An access log is the only way a patient can see who read their record; this one showed staff with no care role.","sourceType":"regulator_decision","lang":"pt","providerName":"Unidade Local de Saúde do Médio Tejo, E.P.E.","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PRT","country":"Portugal","date":"2026-07-29","headline":"Hospital demanded an ID card copy before releasing a patient's records to their lawyer","paraphrase":"A patient's lawyer asked for certified copies of the full record with a signed special power of attorney. The hospital insisted on a copy of the patient's ID card and ignored the commission; it ruled the demand unjustified.","source":"Comissão de Acesso aos Documentos Administrativos (CADA), Parecer 406/2026","url":"https://www.cada.pt/files/pareceres/2026/406.pdf","theme":"access_refused","status":"finding","id":"PRT-S002","pageUrl":"https://healthrecordrights.com/real-cases/#PRT-S002","countryUrl":"https://healthrecordrights.com/brief/portugal/","why":"Extra paperwork demands can stall a patient's right to copies of their own file.","sourceType":"regulator_decision","lang":"pt","providerName":"Unidade Local de Saúde do Alto Ave, E.P.E.","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PRT","country":"Portugal","date":"2026-01-28","headline":"Patient says hospital resent the same report with only a new date","paraphrase":"A patient in the Algarve asked for a clinical report needed for care abroad. The patient says the hospital then resent an earlier report with only the date changed; the commission told it to check and supply what was missing.","source":"Comissão de Acesso aos Documentos Administrativos (CADA), Parecer 48/2026","url":"https://www.cada.pt/files/pareceres/2026/048.pdf","theme":"record_wrong","status":"finding","id":"PRT-S003","pageUrl":"https://healthrecordrights.com/real-cases/#PRT-S003","countryUrl":"https://healthrecordrights.com/brief/portugal/","why":"A patient needing a report to get care abroad waited, then got an old copy they say was wrong.","sourceType":"regulator_decision","lang":"pt","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PRT","country":"Portugal","date":"2025-12-17","headline":"Hospital ignored repeated requests for a patient's own records and the regulator","paraphrase":"A patient asked a public hospital group several times for her own clinical records without success. The hospital did not answer the commission either; it ruled the records must be released, or their absence explained.","source":"Comissão de Acesso aos Documentos Administrativos (CADA), Parecer 481/2025","url":"https://www.cada.pt/files/pareceres/2025/481.pdf","theme":"access_refused","status":"finding","id":"PRT-S004","pageUrl":"https://healthrecordrights.com/real-cases/#PRT-S004","countryUrl":"https://healthrecordrights.com/brief/portugal/","why":"Patients own their health information under Portuguese law; silence leaves them with no copy at all.","sourceType":"regulator_decision","lang":"pt","providerName":"Unidade Local de Saúde do Alto Minho, E.P.E.","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"PRT","country":"Portugal","date":"2025-11-19","headline":"Part of a patient's file stayed missing despite repeated requests","paraphrase":"A patient in Madeira received some records but, after repeated requests, a key part of the file was still missing. The health service did not reply to the commission, which ruled it must provide the records or justify refusal.","source":"Comissão de Acesso aos Documentos Administrativos (CADA), Parecer 437/2025","url":"https://www.cada.pt/files/pareceres/2025/437.pdf","theme":"access_delay_or_cost","status":"finding","id":"PRT-S005","pageUrl":"https://healthrecordrights.com/real-cases/#PRT-S005","countryUrl":"https://healthrecordrights.com/brief/portugal/","why":"A partial copy can leave out the very records a patient needs.","sourceType":"regulator_decision","lang":"pt","providerName":"SESARAM - Serviço de Saúde da Região Autónoma da Madeira, EPERAM","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"QAT","country":"Qatar","date":"2026-08-06","headline":"Patients in Qatar pay and wait again for the same medical report","paraphrase":"Patients told the newspaper that government offices reject medical reports older than six months, so they must request new ones, wait about 14 working days and pay 50 riyals each time, though nothing has changed.","source":"Al-Sharq","url":"https://al-sharq.com/article/06/08/2026/%D8%B0%D9%88%D9%88-%D8%A5%D8%B9%D8%A7%D9%82%D8%A9-%D8%AF%D8%A7%D8%A6%D9%85%D8%A9-%D9%84%D9%80-%D8%A7%D9%84%D8%B4%D8%B1%D9%82-%D8%AA%D8%AC%D8%AF%D9%8A%D8%AF-%D8%A7%D9%84%D8%AA%D9%82%D8%A7%D8%B1%D9%8A%D8%B1-%D8%A7%D9%84%D8%B7%D8%A8%D9%8A%D8%A9-%D9%85%D8%B9%D8%A7%D9%86%D8%A7%D8%A9-%D8%AF%D8%A7%D8%A6%D9%85%D8%A9-%D8%AA%D8%A8%D8%AD%D8%AB-%D8%B9%D9%86-%D8%AD%D9%84","theme":"access_delay_or_cost","status":"self_reported","id":"QAT-S001","pageUrl":"https://healthrecordrights.com/real-cases/#QAT-S001","countryUrl":"https://healthrecordrights.com/brief/qatar/","why":"Patients say paying 50 riyals and waiting two weeks to reissue a report they already hold delays access to services.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ROU","country":"Romania","date":"2026-02-20","headline":"Regulator fines dental clinic after ex-employee took patient files to a rival","paraphrase":"A former employee copied every patient's contact details and medical file and used them to invite patients to a competing clinic. The clinic then failed to answer the regulator, which fined it.","source":"ANSPDCP (National Supervisory Authority for Personal Data Processing)","url":"https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_20_02_2026","theme":"sold_or_shared","status":"finding","id":"ROU-S001","pageUrl":"https://healthrecordrights.com/real-cases/#ROU-S001","countryUrl":"https://healthrecordrights.com/brief/romania/","why":"Patients' files can follow a departing employee to a competitor without their knowledge.","sourceType":"regulator_decision","lang":"ro","providerName":"SC Hayat Dent SRL","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ROU","country":"Romania","date":"2025-02-27","headline":"Clinic fined for ignoring a patient's two requests for their own medical file","paraphrase":"A patient asked a clinic twice for their medical data and file documents and got no answer. The regulator found no evidence of any reply, fined the clinic and ordered full responses and staff training.","source":"ANSPDCP (National Supervisory Authority for Personal Data Processing)","url":"https://www.dataprotection.ro/?page=Comunicat_Presa_27.02.2025&lang=ro","theme":"access_refused","status":"finding","id":"ROU-S002","pageUrl":"https://healthrecordrights.com/real-cases/#ROU-S002","countryUrl":"https://healthrecordrights.com/brief/romania/","why":"Patients have a legal right to their file; this shows a clinic simply not answering.","sourceType":"regulator_decision","lang":"ro","providerName":"Velvet Medical SRL","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ROU","country":"Romania","date":"2025-02-20","headline":"Clinic emailed one patient's test results to another patient, regulator finds","paraphrase":"A clinic sent a patient's identity number, contact details and test results to another patient by unsecured email, and sent that patient's data back the other way. It told neither patient nor the regulator, which fined it.","source":"ANSPDCP (National Supervisory Authority for Personal Data Processing)","url":"https://www.dataprotection.ro/?page=Comunicat_Presa_20_02_2025","theme":"breach","status":"finding","id":"ROU-S003","pageUrl":"https://healthrecordrights.com/real-cases/#ROU-S003","countryUrl":"https://healthrecordrights.com/brief/romania/","why":"A simple email mistake exposed identity numbers and test results to a stranger.","sourceType":"regulator_decision","lang":"ro","providerName":"Medstar S.R.L.","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ROU","country":"Romania","date":"2026-02-19","headline":"Discharge papers listed treatment sessions that never happened, insurer says","paraphrase":"A patient complained that a private clinic kept their health insurance card. When it was returned, the discharge papers recorded treatment sessions the national insurer says were fictitious. The insurer applied a contractual penalty to the clinic.","source":"Stiripesurse.ro","url":"https://www.stiripesurse.ro/cadre-medicale-dintr-o-clinica-din-craiova-acuzate-de-decontari-fictive-cnas-a-amendat-unitatea-dupa-ce-unui-barbat-i-a-fost-retinut-cardul-de-sanatate_3860894","theme":"record_wrong","status":"alleged","id":"ROU-S004","pageUrl":"https://healthrecordrights.com/real-cases/#ROU-S004","countryUrl":"https://healthrecordrights.com/brief/romania/","why":"Fictitious entries billed to the insurer also end up in the patient's own record.","sourceType":"journalism","lang":"ro","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ROU","country":"Romania","date":"2026-09-22","headline":"Weeks after launch, patients still cannot open their online medical record","paraphrase":"Patients trying to use the new national health record portal report waiting about two weeks for identity validation. Those who get in often see only a few prescriptions, not their full medical history.","source":"DeFapt.ro","url":"https://defapt.ro/eveniment/problemele-platformei-e-sanatatea-mea","theme":"access_delay_or_cost","status":"alleged","id":"ROU-S005","pageUrl":"https://healthrecordrights.com/real-cases/#ROU-S005","countryUrl":"https://healthrecordrights.com/brief/romania/","why":"The new national portal promised access to records, but identity checks and gaps delay it.","sourceType":"journalism","lang":"ro","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"RUS","country":"Russia","date":"2026-07-17","headline":"Hospital worker opened a patient's electronic record without cause, health ministry confirmed","paraphrase":"A patient in the Bashkortostan region learned people outside her care knew details from her medical file. The regional health ministry confirmed a worker at another hospital had accessed it unlawfully and dismissed him, but refused her the inspection file.","source":"Пруфы","url":"https://prufy.ru/news/society/188845-skandal_s_utechkoy_dannykh_v_pravitelstvennoy_bolnitse_ufy_doshel_do_sledstviya/","theme":"breach","status":"finding","id":"RUS-S001","pageUrl":"https://healthrecordrights.com/real-cases/#RUS-S001","countryUrl":"https://healthrecordrights.com/brief/russia/","why":"A shared regional record system let staff at a hospital the patient never used read her file.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"RUS","country":"Russia","date":"2026-04-22","headline":"Inspection finds ambulance service head passed patients' data to outside parties","paraphrase":"An unplanned inspection by the Vologda regional health ministry found that the head of an ambulance service had passed data on patients it carried to third parties. He was dismissed and the material was sent to oversight bodies.","source":"Медвестник","url":"https://medvestnik.ru/content/news/glavvracha-skoroi-pomoshi-vologdy-uvolili-za-utechku-dannyh-pacientov.html","theme":"sold_or_shared","status":"finding","id":"RUS-S002","pageUrl":"https://healthrecordrights.com/real-cases/#RUS-S002","countryUrl":"https://healthrecordrights.com/brief/russia/","why":"Data taken when people call an ambulance was handed to third parties by the person meant to guard it.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"RUS","country":"Russia","date":"2025-08-21","headline":"Court rules a patient cannot claim damages for false entries in his record","paraphrase":"A man in the Astrakhan region found his record held a relative's history, entered when the relative was treated under his documents. Another hospital refused him care. The cassation court overturned his damages award, finding the error his own.","source":"РАПСИ","url":"https://rapsinews.ru/judicial_news/20250821/311095872.html","theme":"record_wrong","status":"finding","id":"RUS-S003","pageUrl":"https://healthrecordrights.com/real-cases/#RUS-S003","countryUrl":"https://healthrecordrights.com/brief/russia/","why":"A wrong history in a record followed the patient to another hospital, which refused him care.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"RUS","country":"Russia","date":"2025-05-14","headline":"Court upholds damages after a clinic lost a patient's record during a merger","paraphrase":"In a review of court practice, a clinic could not produce a patient's record for expert review because it was not transferred when two clinics merged. Courts held the successor clinic responsible for keeping it and ordered compensation.","source":"КонсультантПлюс","url":"https://www.consultant.ru/legalnews/28446/","theme":"lost_between_providers","status":"finding","id":"RUS-S004","pageUrl":"https://healthrecordrights.com/real-cases/#RUS-S004","countryUrl":"https://healthrecordrights.com/brief/russia/","why":"When clinics merge, records can vanish, and with them the patient's ability to prove what happened.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"RUS","country":"Russia","date":"2025-07-30","headline":"Clinic network confirms hacker attack disrupted services; says no leak confirmed","paraphrase":"Hackers broke into a private clinic network owned by an insurer, the company confirmed, alongside attacks on two pharmacy chains. Services were disrupted; the clinic said patient data leakage had not been confirmed.","source":"Коммерсантъ","url":"https://www.kommersant.ru/doc/7925020","theme":"breach","status":"admitted","id":"RUS-S005","pageUrl":"https://healthrecordrights.com/real-cases/#RUS-S005","countryUrl":"https://healthrecordrights.com/brief/russia/","why":"An attack on a clinic network can cut patients off from their records and put sensitive data at risk.","sourceType":"journalism","lang":"ru","providerName":"Семейный доктор","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SMR","country":"San Marino","date":"2026-02-10","headline":"Lab results stopped reaching patients' online health records for several days","paraphrase":"The state health service said a technical fault outside its control blocked lab results from loading into the electronic health record for days. It mailed paper copies meanwhile, apologised, and offered help to anyone still missing results.","source":"San Marino RTV","url":"https://www.sanmarinortv.sm/news/comunicati-c9/fascicolo-sanitario-elettronico-ripristinata-la-disponibilita-dei-referti-di-laboratorio-a286305","theme":"access_delay_or_cost","status":"admitted","id":"SMR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#SMR-S001","countryUrl":"https://healthrecordrights.com/brief/san-marino/","why":"Since January 2026 lab results are no longer posted, so an outage of the online record leaves patients without their results.","sourceType":"journalism","lang":"it","providerName":"Istituto per la Sicurezza Sociale (ISS)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SAU","country":"Saudi Arabia","date":"2026-09-18","headline":"Ministry penalised practitioners who filmed patients during care and posted the clips","paraphrase":"The paper reported cases documented by the health ministry in which practitioners photographed patients during care and published the images online. In one case the ministry cancelled a licence and imposed a fine.","source":"Al Watan (Saudi Arabia)","url":"https://www.alwatan.com.sa/article/1185817","theme":"breach","status":"finding","id":"SAU-S001","pageUrl":"https://healthrecordrights.com/real-cases/#SAU-S001","countryUrl":"https://healthrecordrights.com/brief/saudi-arabia/","why":"Images taken during care are private health information, and posting them exposes the patient.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SAU","country":"Saudi Arabia","date":"2026-05-07","headline":"Patients say hospital call centres abroad asked for their full personal details","paraphrase":"Callers told the paper that hospital booking lines, staffed from outside the kingdom, asked for ID numbers, birth dates and full patient details before sending them to an app. Security specialists warned of leak and misuse risks.","source":"Al Watan","url":"https://www.alwatan.com.sa/article/1180355","theme":"sold_or_shared","status":"alleged","id":"SAU-S003","pageUrl":"https://healthrecordrights.com/real-cases/#SAU-S003","countryUrl":"https://healthrecordrights.com/brief/saudi-arabia/","why":"Booking lines that collect identity and patient details off-shore can move health data outside local oversight.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SEN","country":"Senegal","date":"2026-02-12","headline":"Regulator orders a private clinic to remove cameras filming its treatment rooms","paraphrase":"After an anonymous report and an inspection, the national data protection commission ordered the clinic to take down cameras in its treatment rooms, switch off sound recording and declare its system properly.","source":"Commission de Protection des Données Personnelles (CDP), Avis trimestriel N°04-2025","url":"https://sppsyrftszniuaicadvk.supabase.co/storage/v1/object/public/public_docs/avis-trimestriels/avis-trimestriel-1770976600440.pdf","theme":"other","status":"finding","id":"SEN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#SEN-S001","countryUrl":"https://healthrecordrights.com/brief/senegal/","why":"Patients in a care room should not be filmed or recorded; the data regulator made the clinic stop.","sourceType":"regulator_decision","lang":"fr","providerName":"Clinique Dentaire DABIA","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SEN","country":"Senegal","date":"2026-04-07","headline":"Test results of people arrested in a crackdown published in national newspapers","paraphrase":"Reporters found that people arrested in a police crackdown were routinely tested, and their test results and names were then printed in national newspapers. Health workers said frightened patients are now staying away from clinics.","source":"The Guardian","url":"https://www.theguardian.com/global-development/2026/apr/07/senegal-harsh-anti-gay-law-hiv-progress","theme":"breach","status":"alleged","id":"SEN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#SEN-S002","countryUrl":"https://healthrecordrights.com/brief/senegal/","why":"When test results leave the clinic and reach the press, patients stop coming for care.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SEN","country":"Senegal","date":"2026-02-12","headline":"Public health council warns that publicising detainees' health status breaks the law","paraphrase":"A national public health council said wide media coverage of arrests had exposed people's health status, noted that unauthorised disclosure is punished under a 2010 law and may engage state liability, and warned people may avoid testing.","source":"Le Quotidien","url":"https://lequotidien.sn/sida-menace-sur-la-continuite-des-soins-circulation-du-virus-abandon-de-traitement-erreurs-judiciaires-les-inquietudes-du-cnls/","theme":"breach","status":"alleged","id":"SEN-S003","pageUrl":"https://healthrecordrights.com/real-cases/#SEN-S003","countryUrl":"https://healthrecordrights.com/brief/senegal/","why":"A national health body says disclosing a patient's status without consent is a crime and puts care at risk.","sourceType":"journalism","lang":"fr","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SEN","country":"Senegal","date":"2026-02-09","headline":"Police press release quoted a medical certificate about a person in custody","paraphrase":"BBC reported that a gendarmerie press release quoted a medical certificate from a test that police had ordered on a person in custody, including what it found.","source":"BBC News Afrique","url":"https://www.bbc.com/afrique/articles/c1mj0mnl8lro","theme":"sold_or_shared","status":"alleged","id":"SEN-S004","pageUrl":"https://healthrecordrights.com/real-cases/#SEN-S004","countryUrl":"https://healthrecordrights.com/brief/senegal/","why":"A medical certificate made under police order ended up in a public statement, outside any care setting.","sourceType":"journalism","lang":"fr","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SRB","country":"Serbia","date":"2026-04-03","headline":"Thousands of patients' medical reports from a private clinic appear on the dark web","paraphrase":"Records of about 6,500 patients of a private clinic, with names, addresses, phone numbers and doctors' reports, were posted online. The data protection commissioner opened an inspection and said the clinic had not yet reported the breach.","source":"Danas","url":"https://www.danas.rs/vesti/drustvo/poverenik-marinovic-od-ginekoloske-klinike-nismo-jos-dobili-odgovor-o-curenju-podataka-pacijentkinja/","theme":"breach","status":"alleged","id":"SRB-S001","pageUrl":"https://healthrecordrights.com/real-cases/#SRB-S001","countryUrl":"https://healthrecordrights.com/brief/serbia/","why":"Records holding names, addresses and doctors' reports can be exposed without patients being told.","sourceType":"journalism","lang":"sr","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SRB","country":"Serbia","date":"2026-08-18","headline":"Forum claim says national health insurer database was breached; insurer cannot yet confirm","paraphrase":"A forum poster claimed to have breached the national health insurer's database and offered data for sale, posting a sample of over 342,000 records linking insured people's identity numbers to their chosen doctors. The insurer is reviewing but cannot confirm.","source":"Srpske Novine (srpske.rs)","url":"https://srpske.rs/en/news/lifestyle/2026/08/18/rfzo-checks-systems-after-database-breach-claims","theme":"breach","status":"alleged","id":"SRB-S002","pageUrl":"https://healthrecordrights.com/real-cases/#SRB-S002","countryUrl":"https://healthrecordrights.com/brief/serbia/","why":"Leaked insurer records tie lifelong ID numbers to the doctors people see, revealing where they seek care.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-04","addedOn":"2026-10-04","inLanguage":"en"},{"iso3":"SGP","country":"Singapore","date":"2025-05-21","headline":"Patient's record used to approach them for research without express consent","paraphrase":"A patient complained that a hospital researcher, given the patient's name by their doctor, approached them in a waiting area to join a study. The regulator found implied consent sufficed but said express consent would have been better practice.","source":"Personal Data Protection Commission Singapore","url":"https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/commissions-decisions/gd_institute-of-mental-health_21052025.pdf","theme":"other","status":"finding","id":"SGP-S001","pageUrl":"https://healthrecordrights.com/real-cases/#SGP-S001","countryUrl":"https://healthrecordrights.com/brief/singapore/","why":"Shows how far a hospital may use a patient's record inside the organisation, here to pick research recruits, without asking first.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SGP","country":"Singapore","date":"2025-04-11","headline":"Hospital worker fined for looking up a former patient's record without reason","paraphrase":"A hospital staff member opened a former patient's record on the hospital system for personal reasons and filmed the screen showing their ID number, address and contacts. The patient complained; she pleaded guilty and was fined.","source":"HRD Asia (HCA Magazine)","url":"https://www.hcamag.com/asia/specialisation/employment-law/nuh-employee-fined-for-unauthorised-access-of-patient-information-reports/531778","theme":"breach","status":"finding","id":"SGP-S002","pageUrl":"https://healthrecordrights.com/real-cases/#SGP-S002","countryUrl":"https://healthrecordrights.com/brief/singapore/","why":"Staff with system access can look up a patient for personal reasons; the patient found out only because a video surfaced.","sourceType":"journalism","lang":"en","providerName":"National University Hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SGP","country":"Singapore","date":"2025-06-13","headline":"Former specialist centre employee charged with accessing patients' data without authorisation","paraphrase":"A former public specialist centre employee was charged with accessing personal data of 18 patients without authorisation and downloading photos of 42 patients from its systems. The centre said it began an internal probe and filed a police report.","source":"Malay Mail (citing CNA)","url":"https://www.malaymail.com/news/singapore/2025/06/13/former-national-dental-centre-singapore-staff-accused-of-taking-illicit-photos-of-female-patients-breasts/180231","theme":"breach","status":"alleged","id":"SGP-S003","pageUrl":"https://healthrecordrights.com/real-cases/#SGP-S003","countryUrl":"https://healthrecordrights.com/brief/singapore/","why":"Shows how an insider can reach patient files and photos held on clinic systems before anyone notices.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SGP","country":"Singapore","date":"2026-09-20","headline":"Specialist centre's email error let 467 invitees see each other's addresses","paraphrase":"A public specialist centre emailed an invitation to a patient event using CC instead of BCC, so all 467 recipients could see each other's addresses. The centre apologised and reported the incident to the health ministry and the privacy regulator.","source":"AsiaOne","url":"https://www.asiaone.com/singapore/national-cancer-centre-email-leak","theme":"breach","status":"admitted","id":"SGP-S004","pageUrl":"https://healthrecordrights.com/real-cases/#SGP-S004","countryUrl":"https://healthrecordrights.com/brief/singapore/","why":"A visible address list can reveal who attends a patient event, and work addresses reveal employers.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SVK","country":"Slovakia","date":"2025-04-30","headline":"Patient waits over six months as former doctor holds records after a switch","paraphrase":"A patient who changed general practitioner says the former doctor did not pass his records to the new one for over six months. Other former patients report the same, and a regional complaint is under review.","source":"STVR Správy (Slovak public broadcaster)","url":"https://spravy.stvr.sk/2025/04/pan-peter-ostal-bez-pristupu-k-svojej-zdravotnej-dokumentacii-lekar-na-jeho-ziadost-o-presun-zaznamov-nereaguje/","theme":"lost_between_providers","status":"alleged","id":"SVK-S001","pageUrl":"https://healthrecordrights.com/real-cases/#SVK-S001","countryUrl":"https://healthrecordrights.com/brief/slovakia/","why":"When a patient changes doctor, the old practice must pass the records on; here they stayed stuck for months.","sourceType":"journalism","lang":"sk","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SVK","country":"Slovakia","date":"2025-12-07","headline":"Dentists say national eHealth record lacks dental charts and images","paraphrase":"The dentists' chamber says dental charts and image files do not reach the national electronic record, so other doctors cannot see them. It warns patients may get duplicate prescriptions or repeat imaging as a result.","source":"Pravda","url":"https://www.pravda.sk/zdravie/zdravie-a-prevencia/clanok/777566-zubni-lekari-si-stazuju-ze-v-ezdravi-chybaju-dolezite-udaje-pre-diagnostiku-a-rozhodovanie-o-liecbe","theme":"lost_between_providers","status":"alleged","id":"SVK-S002","pageUrl":"https://healthrecordrights.com/real-cases/#SVK-S002","countryUrl":"https://healthrecordrights.com/brief/slovakia/","why":"Records missing from the shared system can mean repeat tests and doctors working without the full picture.","sourceType":"journalism","lang":"sk","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SVK","country":"Slovakia","date":"2025-01-25","headline":"Cyberattack tried to take patient data from the main state health insurer","paraphrase":"The government said attackers targeted the state health insurer seeking patients' personal and treatment data. The health minister said the attack was repelled, and the insurer stated policyholders' data were safe and had not leaked.","source":"Bratislavak.sk","url":"https://www.bratislavak.sk/clanky/5645/aktualizovane-kyberneticky-utok-na-vszp-sa-podarilo-odrazit-vyhlasil-sasko-k-uniku-dat-nedoslo","theme":"breach","status":"admitted","id":"SVK-S003","pageUrl":"https://healthrecordrights.com/real-cases/#SVK-S003","countryUrl":"https://healthrecordrights.com/brief/slovakia/","why":"The national insurer holds claims for most residents; one attack there puts nearly everyone's health history at risk.","sourceType":"journalism","lang":"sk","providerName":"Všeobecná zdravotná poisťovňa","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SVN","country":"Slovenia","date":"2026-09-18","headline":"Hospital confirms employee shared photos of patients and a document with personal data","paraphrase":"A hospital employee photographed patients and a document holding sensitive personal data and shared the images outside the hospital. The hospital confirmed it, disciplined the worker and reported the case to the data protection authority and police.","source":"N1 Slovenija","url":"https://n1info.si/novice/slovenija/zaposlena-v-ukc-ljubljana-fotografirala-bolnike-med-zdravljenjem-in-delila-slike/","theme":"breach","status":"admitted","id":"SVN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#SVN-S001","countryUrl":"https://healthrecordrights.com/brief/slovenia/","why":"Staff with access to patients and their papers can leak them; the hospital says it disciplined the worker.","sourceType":"journalism","lang":"sl","providerName":"UKC Ljubljana","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SVN","country":"Slovenia","date":"2024-10-05","headline":"Clinic confirms a nurse repeatedly opened a former patient's record without authorisation","paraphrase":"A former patient complained that a staff member had viewed her health record while she was not in care there. The clinic confirmed repeated unauthorised access and misuse of login details, and notified police and the data protection authority.","source":"Žurnal24","url":"https://www.zurnal24.si/slovenija/ljubljana-vohljala-je-za-zdravjem-pacientke-univerzitetna-psihiatricna-klinika-bojan-zalar-ministrica-izredni-nadzor-430457","theme":"breach","status":"admitted","id":"SVN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#SVN-S002","countryUrl":"https://healthrecordrights.com/brief/slovenia/","why":"Patients can only learn who looked at their file if access is logged and checked; here a complaint exposed misuse.","sourceType":"journalism","lang":"sl","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SVN","country":"Slovenia","date":"2025-01-15","headline":"Patient test results and operation lists reported found in the rubbish","paraphrase":"A TV programme received a bag of patients' results, operation lists and doctors' notes said to have been thrown out by a hospital. The hospital disputed where the bag came from; the data protection authority opened an inspection.","source":"RTV Slovenija","url":"https://www.rtvslo.si/zdravje/v-smeteh-koncali-izvidi-pacientov-in-druga-obcutljiva-dokumentacija-iz-celjske-bolnisnice/733409","theme":"breach","status":"alleged","id":"SVN-S003","pageUrl":"https://healthrecordrights.com/real-cases/#SVN-S003","countryUrl":"https://healthrecordrights.com/brief/slovenia/","why":"Paper records thrown away unshredded expose names and health details to anyone who finds them.","sourceType":"journalism","lang":"sl","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SVN","country":"Slovenia","date":"2025-12-29","headline":"Patient receives two wrong scan reports, one apparently belonging to someone else","paraphrase":"A patient says his first imaging report described the wrong part of the body and a corrected report mentioned a procedure that was never done, suggesting a mix-up with another patient. He says staff told him mistakes happen.","source":"Necenzurirano.si","url":"https://necenzurirano.si/clanek/preiskave/radiologi-preiskava-magnetna-resonanca-napaka-zzzs-ukc-maribor-zdravniki-1870449","theme":"record_wrong","status":"alleged","id":"SVN-S004","pageUrl":"https://healthrecordrights.com/real-cases/#SVN-S004","countryUrl":"https://healthrecordrights.com/brief/slovenia/","why":"A wrong report in a patient's file can steer decisions about care; the patient says staff shrugged it off.","sourceType":"journalism","lang":"sl","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SVN","country":"Slovenia","date":"2026-01-15","headline":"Patient handed another person's test result by mistake","paraphrase":"A patient received a test report carrying another person's name and findings, and only learned of the mistake when his doctor pointed it out. The Ministry of Health called this kind of mix-up a serious safety incident.","source":"Svet24","url":"https://svet24.si/novice/slovenija/bolnik-izvid-napaka-incident-bolezen-1873740","theme":"record_wrong","status":"alleged","id":"SVN-S005","pageUrl":"https://healthrecordrights.com/real-cases/#SVN-S005","countryUrl":"https://healthrecordrights.com/brief/slovenia/","why":"A result filed under the wrong person both alarms one patient and delays news for the other.","sourceType":"journalism","lang":"sl","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ZAF","country":"South Africa","date":"2025-11-26","headline":"Pathology lab fined after failing to tell patients their data was exposed","paraphrase":"The regulator found the lab had suffered breaches and not notified affected people within a reasonable time. It ordered better security and notification processes, then fined the lab R100,000 for not complying. The lab paid.","source":"Juta MedicalBrief (reporting an Information Regulator decision)","url":"https://www.medicalbrief.co.za/lancet-labs-fined-for-data-breach/","theme":"breach","status":"finding","id":"ZAF-S002","pageUrl":"https://healthrecordrights.com/real-cases/#ZAF-S002","countryUrl":"https://healthrecordrights.com/brief/south-africa/","why":"People whose lab data leaks have a right to be told quickly so they can protect themselves.","sourceType":"journalism","lang":"en","providerName":"Lancet Laboratories","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ZAF","country":"South Africa","date":"2025-07-22","headline":"Provincial health department says lost and misplaced files have harmed patients' care","paraphrase":"Launching a records digitisation drive, the provincial health MEC said patients' care had been interrupted by misplaced records, delayed care and lost files, compromising patient safety and exposing the department to legal claims.","source":"SABC News","url":"https://www.sabcnews.com/sabcnews/gauteng-based-public-hospitals-patients-records-going-digital/","theme":"other","status":"admitted","id":"ZAF-S003","pageUrl":"https://healthrecordrights.com/real-cases/#ZAF-S003","countryUrl":"https://healthrecordrights.com/brief/south-africa/","why":"Paper files that go missing can delay care and leave patients without their history.","sourceType":"journalism","lang":"en","providerName":"Gauteng Department of Health","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"KOR","country":"South Korea","date":"2025-03-19","headline":"Rights commission finds a hospital routinely wrote false entries in a patient's record","paraphrase":"After a patient died in hospital, the commission found staff had, as a routine practice, recorded a doctor as giving orders that the doctor never gave. It referred hospital staff to prosecutors and recommended changes to the law.","source":"National Human Rights Commission of Korea","url":"https://www.humanrights.go.kr/base/board/read?boardManagementNo=24&boardNo=7611008&searchCategory=&page=4&searchType=&searchWord=&menuLevel=3&menuNo=91","theme":"record_wrong","status":"finding","id":"KOR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#KOR-S001","countryUrl":"https://healthrecordrights.com/brief/south-korea/","why":"A record that names the wrong person as giving orders cannot be trusted later by the patient, family or investigators.","sourceType":"regulator_decision","lang":"ko","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"KOR","country":"South Korea","date":"2026-09-14","headline":"Doctor took thousands of patients' details; hospital fined for late notice, not the leak","paraphrase":"A doctor deliberately took 3,976 patients' personal data while preparing to open a practice. The privacy regulator fined the hospital for late notification and weak supervision of staff, but found no breach of security duties.","source":"Hankyung (Korea Economic Daily)","url":"https://www.hankyung.com/article/202609143107H","theme":"breach","status":"finding","id":"KOR-S002","pageUrl":"https://healthrecordrights.com/real-cases/#KOR-S002","countryUrl":"https://healthrecordrights.com/brief/south-korea/","why":"When an insider takes records, current rules may leave the hospital with only a small fine and patients told late.","sourceType":"journalism","lang":"ko","providerName":"Kyungpook National University Hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"KOR","country":"South Korea","date":"2024-12-27","headline":"Hospital doctors passed patients' prescription records to a drug company, court rules","paraphrase":"Three senior doctors at a Seoul hospital gave drug company staff patients' prescription records, more than 17,000 entries, at the company's request. A court fined the doctors and the hospital's operator for failing to prevent it.","source":"Pharmnews","url":"https://www.pharmnews.com/news/articleView.html?idxno=256304","theme":"sold_or_shared","status":"finding","id":"KOR-S003","pageUrl":"https://healthrecordrights.com/real-cases/#KOR-S003","countryUrl":"https://healthrecordrights.com/brief/south-korea/","why":"Prescription records were handed to a company for sales use without patients knowing; the hospital operator was fined too.","sourceType":"journalism","lang":"ko","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"KOR","country":"South Korea","date":"2026-09-07","headline":"Court fines dentist for writing false entries in a patient's record","paraphrase":"A court fined a dentist one million won for writing a smaller medication amount in a patient's record than was actually given, and for recording health checks that were never carried out.","source":"Law Issue (로이슈)","url":"https://www.lawissue.co.kr/view.php?ud=2026090617253378379a8c8bf58f_12","theme":"record_wrong","status":"finding","id":"KOR-S004","pageUrl":"https://healthrecordrights.com/real-cases/#KOR-S004","countryUrl":"https://healthrecordrights.com/brief/south-korea/","why":"A record that understates what was given or claims checks never done misleads every clinician who reads it later.","sourceType":"journalism","lang":"ko","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"KOR","country":"South Korea","date":"2026-09-14","headline":"Staff at public health agencies looked up personal data for private reasons, files show","paraphrase":"Disciplinary files that the public health insurer and claims review agency gave a lawmaker show staff viewing relatives' and an ex-partner's data, querying colleagues, and emailing sensitive screening files home. Penalties ranged from reprimand to dismissal.","source":"Money Today (머니투데이)","url":"https://www.mt.co.kr/thebio/2026/09/14/2026091409464048356","theme":"breach","status":"alleged","id":"KOR-S005","pageUrl":"https://healthrecordrights.com/real-cases/#KOR-S005","countryUrl":"https://healthrecordrights.com/brief/south-korea/","why":"Staff at the public insurer and claims reviewer can see everyone's data; their own discipline files show misuse.","sourceType":"journalism","lang":"ko","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ESP","country":"Spain","date":"2026-04-20","headline":"Clinic charged a patient 30 euros for a first copy of her record","paraphrase":"After leaving her private insurer, a patient had to request her record in person and pay 30 euros in cash for a one-page copy. The regulator found the charge unlawful; the clinic accepted responsibility and paid a reduced fine.","source":"Agencia Española de Protección de Datos (AEPD), PS-00560-2025 (EXP202503617)","url":"https://www.aepd.es/documento/ps-00560-2025.pdf","archiveUrl":"https://web.archive.org/web/20261005165031/https://www.aepd.es/documento/ps-00560-2025.pdf","theme":"access_delay_or_cost","status":"finding","id":"ESP-S001","pageUrl":"https://healthrecordrights.com/real-cases/#ESP-S001","countryUrl":"https://healthrecordrights.com/brief/spain/","why":"A first copy of your record is free under data protection law; this clinic charged and then admitted the breach.","sourceType":"regulator_decision","lang":"es","providerName":"Centro Médico Rey Fernando, S.L.P.","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ESP","country":"Spain","date":"2026-07-07","headline":"Occupational health service ignored a request for a medical record for three years","paraphrase":"An employee asked their employer's medical service twice for their full record and got no answer; copies came only after a complaint. The regulator upheld it, citing the right to know who holds the data.","source":"Agencia Española de Protección de Datos (AEPD)","url":"https://www.aepd.es/documento/pd-00068-2026.pdf","archiveUrl":"https://web.archive.org/web/20261005165046/https://www.aepd.es/documento/pd-00068-2026.pdf","theme":"access_refused","status":"finding","id":"ESP-S002","pageUrl":"https://healthrecordrights.com/real-cases/#ESP-S002","countryUrl":"https://healthrecordrights.com/brief/spain/","why":"Patients can ask what their record holds and how it is used; this one waited three years for an answer.","sourceType":"regulator_decision","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ESP","country":"Spain","date":"2025-01-28","headline":"Specialist could not see a report held by another public hospital","paraphrase":"After a long wait for an appointment, a patient was told the specialist could not see a report held at another public hospital and was asked to fetch it herself. The ombudsman recommended records be reachable from every public centre.","source":"Síndic de Greuges de la Comunitat Valenciana (regional ombudsman), complaint 2403790","url":"https://www.elsindic.com/Resoluciones/expedientes/2024/202403790/12238270.pdf","theme":"lost_between_providers","status":"finding","id":"ESP-S003","pageUrl":"https://healthrecordrights.com/real-cases/#ESP-S003","countryUrl":"https://healthrecordrights.com/brief/spain/","why":"When public hospitals cannot see each other's records, the patient ends up carrying the file between them.","sourceType":"regulator_decision","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ESP","country":"Spain","date":"2025-02-07","headline":"Doctor convicted for opening another person's clinical record three times without a care reason","paraphrase":"A primary care doctor used her own login to open a person's clinical record three times, though the person was not her patient. A provincial court gave her a suspended prison term, six years' disqualification and 50,000 euros in damages.","source":"Salud y Medicina","url":"https://saludymedicina.org/post/seis-anos-de-inhabilitacion-y-dos-de-carcel-por-tres-visitas-a-la-historia-clinica-de-su-colega","archiveUrl":"https://web.archive.org/web/20261005165120/https://saludymedicina.org/post/seis-anos-de-inhabilitacion-y-dos-de-carcel-por-tres-visitas-a-la-historia-clinica-de-su-colega","theme":"breach","status":"finding","id":"ESP-S004","pageUrl":"https://healthrecordrights.com/real-cases/#ESP-S004","countryUrl":"https://healthrecordrights.com/brief/spain/","why":"Simply opening a record without a care reason can be a crime in Spain.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ESP","country":"Spain","date":"2026-07-27","headline":"Spanish regulator fines 23andMe after hacker accessed residents' sensitive health data","paraphrase":"Spain's data protection authority fined 23andMe 2.4 million euros after a hacker used stolen passwords to reach sensitive health and genetic data of about 2,600 Spanish residents. The regulator found its safeguards insufficient.","source":"teiss","url":"https://www.teiss.co.uk/news/23andme-hit-with-24-million-fine-after-data-breach-affected-spanish-residents-17893","theme":"breach","status":"finding","id":"ESP-S005","pageUrl":"https://healthrecordrights.com/real-cases/#ESP-S005","countryUrl":"https://healthrecordrights.com/brief/spain/","why":"Genetic and health data held by consumer testing firms can be stolen when safeguards such as multi-factor login are missing.","sourceType":"journalism","lang":"en","providerName":"23andMe","lastVerified":"2026-10-04","addedOn":"2026-10-04","inLanguage":"en"},{"iso3":"LKA","country":"Sri Lanka","date":"2025-08-13","headline":"Nearly 400,000 records from a national health website offered for sale online","paraphrase":"A seller on a breach forum offered about 398,000 records said to include patients' national ID numbers, phone numbers, addresses and medical appointment details. The report said no official statement had been issued.","source":"ReadMe","url":"https://readme.lk/ministry-of-health-hack-likely-compromised-nearly-400000-records/","theme":"breach","status":"alleged","id":"LKA-S001","pageUrl":"https://healthrecordrights.com/real-cases/#LKA-S001","countryUrl":"https://healthrecordrights.com/brief/sri-lanka/","why":"Stolen health records with ID numbers, addresses and appointment details expose patients to fraud and loss of privacy.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"LKA","country":"Sri Lanka","date":"2024-11-29","headline":"Doctor booking website let anyone look up patient details by name","paraphrase":"A public search page on an appointment booking platform reportedly showed patients' names, national ID numbers, phone numbers and appointment history. It came down only after a public post, and users were not told.","source":"ReadMe","url":"https://readme.lk/mobitel-echannelling-website-had-a-data-leak-problem/","theme":"breach","status":"alleged","id":"LKA-S002","pageUrl":"https://healthrecordrights.com/real-cases/#LKA-S002","countryUrl":"https://healthrecordrights.com/brief/sri-lanka/","why":"An open search page can reveal who saw which doctor, for years, to anyone who types a name.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SDN","country":"Sudan","date":"2026-08-10","headline":"Patient files left behind when a specialist hospital closed in the war","paraphrase":"A hospital official said staff left and patient files and data stayed inside after the building was taken over. Displaced patients lost the link to their records and doctors, and some now carry their own papers between centres.","source":"Independent Arabia","url":"https://www.independentarabia.com/node/655365/%D8%B3%D9%8A%D8%A7%D8%B3%D8%A9/%D8%AA%D9%82%D8%A7%D8%B1%D9%8A%D8%B1/%D9%85%D8%B1%D8%A7%D9%83%D8%B2-%D8%A7%D9%84%D8%A3%D9%88%D8%B1%D8%A7%D9%85-%D9%88%D9%85%D8%B9%D8%B1%D9%83%D8%A9-%D8%A7%D9%84%D8%A8%D9%82%D8%A7%D8%A1-%D9%81%D9%8A-%D8%A7%D9%84%D8%B3%D9%88%D8%AF%D8%A7%D9%86","theme":"lost_between_providers","status":"admitted","id":"SDN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#SDN-S001","countryUrl":"https://healthrecordrights.com/brief/sudan/","why":"When paper files stay in a closed hospital, displaced patients must rebuild their history at every new centre.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SWE","country":"Sweden","date":"2024-11-26","headline":"Region reports new record system to regulator after patient notes went missing","paraphrase":"Within days of a large region switching record systems, staff reported record information that was missing or disappeared, plus failures registering and finding patients. The region reported the system to the medical products regulator and paused it.","source":"SVT Nyheter","url":"https://www.svt.se/nyheter/lokalt/vast/journalsystemet-millennium-anmals-till-lakemedelsverket-igen","theme":"record_wrong","status":"admitted","id":"SWE-S002","pageUrl":"https://healthrecordrights.com/real-cases/#SWE-S002","countryUrl":"https://healthrecordrights.com/brief/sweden/","why":"When a record system loses notes, clinicians treat patients without their full history.","sourceType":"journalism","lang":"sv","providerName":"Västra Götalandsregionen","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SWE","country":"Sweden","date":"2025-02-12","headline":"Patient identity numbers, some linked to diagnosis codes, offered for sale after hack","paraphrase":"A ransomware attack hit a private hospital's administrative systems. The clinical record system was not affected, but personal identity numbers, in some cases linked to diagnosis codes, were stolen and put up for sale. The hospital refused to pay.","source":"Läkartidningen","url":"https://lakartidningen.se/aktuellt/nyheter/2025/02/chefslakare-om-hackerattacken-det-var-dramatiskt/","theme":"breach","status":"admitted","id":"SWE-S003","pageUrl":"https://healthrecordrights.com/real-cases/#SWE-S003","countryUrl":"https://healthrecordrights.com/brief/sweden/","why":"Even when the clinical record survives an attack, data tied to it can end up for sale.","sourceType":"journalism","lang":"sv","providerName":"Sophiahemmet","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SWE","country":"Sweden","date":"2025-11-18","headline":"Region's own review recommends scrapping its troubled patient record system","paraphrase":"A region's 90-page internal report found unclear saving of notes, wrong sample labels, medication lists that could not be printed and prescriptions failing to send. The region had filed ten serious-incident reports and the review recommended dropping the system.","source":"Vårdfokus","url":"https://www.vardfokus.se/nyheter/rapport-uppmanar-vastra-gotaland-att-skrota-millennium-krangligt-och-ologiskt/","theme":"other","status":"admitted","id":"SWE-S004","pageUrl":"https://healthrecordrights.com/real-cases/#SWE-S004","countryUrl":"https://healthrecordrights.com/brief/sweden/","why":"A record system that makes saving notes and medication lists unreliable puts every patient's record at risk.","sourceType":"journalism","lang":"sv","providerName":"Västra Götalandsregionen","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SWE","country":"Sweden","date":"2026-05-28","headline":"Another patient's health declaration was filed in the wrong patient's record","paraphrase":"A health declaration belonging to one patient was placed in another patient's record ahead of planned care. The error was found later. The region reported it under the serious-incident law, saying the wrong information could have affected safety.","source":"Skillingaryd.nu","url":"https://skillingaryd.nu/vaggeryd/nyheter/halsodeklaration-infor-operation-bifogades-i-fel-journal/","theme":"record_wrong","status":"admitted","id":"SWE-S005","pageUrl":"https://healthrecordrights.com/real-cases/#SWE-S005","countryUrl":"https://healthrecordrights.com/brief/sweden/","why":"A mixed-up document can put someone else's medical details into decisions about you.","sourceType":"journalism","lang":"sv","providerName":"Region Jönköpings län","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"SWE","country":"Sweden","date":"2026-06-04","headline":"Nurse convicted for years of unauthorised lookups in patients' records","paraphrase":"A district court convicted a former nurse of data intrusion for unauthorised record lookups over several years, ordering a conditional sentence and 115,000 kronor in damages. Nineteen cases were tried; about 60 people had reported her to police.","source":"SVT Nyheter","url":"https://www.svt.se/nyheter/lokalt/orebro/efter-otillatna-journalslagningar-sjukskoterskan-doms-till-villkorlig-dom","theme":"breach","status":"finding","id":"SWE-S007","pageUrl":"https://healthrecordrights.com/real-cases/#SWE-S007","countryUrl":"https://healthrecordrights.com/brief/sweden/","why":"Patients can check their access logs; here about 60 people reported lookups they never allowed.","sourceType":"journalism","lang":"sv","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CHE","country":"Switzerland","date":"2026-07-06","headline":"Practitioner rebuilt a patient file after the fact, leaving out treatments; conviction upheld","paraphrase":"Patients asked a practitioner for their records and did not get them. Before police questioning he created a new electronic file showing one treatment where the original showed three. The court upheld his forgery conviction.","source":"Swiss Federal Supreme Court (Bundesgericht), 6B_310/2025","url":"https://entscheidsuche.ch/docs/CH_BGer/CH_BGer_006_6B-310-2025_2026-07-06.html","theme":"record_wrong","status":"finding","id":"CHE-S001","pageUrl":"https://healthrecordrights.com/real-cases/#CHE-S001","countryUrl":"https://healthrecordrights.com/brief/switzerland/","why":"When records are not handed over, patients may later be shown a file that is not the original and is incomplete.","sourceType":"court_judgment","lang":"de","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"CHE","country":"Switzerland","date":"2025-09-09","headline":"Family refused a deceased relative's hospital record; top court upholds secrecy after death","paraphrase":"After a patient died in hospital, his relatives sought access to his record. Cantonal authorities refused to release the doctor from secrecy, and the federal court agreed, saying confidentiality outlasts death and applies to relatives too.","source":"Swiss Federal Supreme Court (Bundesgericht), 2C_567/2024","url":"https://entscheidsuche.ch/docs/CH_BGer/CH_BGer_002_2C-567-2024_2025-09-09.html","archiveUrl":"https://web.archive.org/web/20261005161537/https://entscheidsuche.ch/docs/CH_BGer/CH_BGer_002_2C-567-2024_2025-09-09.html","theme":"access_refused","status":"finding","id":"CHE-S002","pageUrl":"https://healthrecordrights.com/real-cases/#CHE-S002","countryUrl":"https://healthrecordrights.com/brief/switzerland/","why":"In Switzerland, relatives may be unable to read a record after a death unless the patient released the doctor from secrecy.","sourceType":"court_judgment","lang":"de","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CHE","country":"Switzerland","date":"2026-05-08","headline":"Radiology network hit by a second cyberattack a year after patient data was stolen","paraphrase":"A radiology network operating in seven cantons was attacked again in April 2026 and postponed some examinations. It could not yet say whether data was taken. In an attack a year earlier, patient data was stolen and a ransom demanded.","source":"Medinside","url":"https://www.medinside.ch/de/ein-jahr-danach-neue-cyberattacke-auf-radiologie-netwerk-20260507","archiveUrl":"https://web.archive.org/web/20261005161559/https://www.medinside.ch/de/ein-jahr-danach-neue-cyberattacke-auf-radiologie-netwerk-20260507","theme":"breach","status":"alleged","id":"CHE-S003","pageUrl":"https://healthrecordrights.com/real-cases/#CHE-S003","countryUrl":"https://healthrecordrights.com/brief/switzerland/","why":"Imaging centres hold records for many patients across cantons; repeated attacks put them at risk.","sourceType":"journalism","lang":"de","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"CHE","country":"Switzerland","date":"2025-01-09","headline":"After a cyberattack, over 100 doctors could not open patient files for a month","paraphrase":"A cyberattack on a medical group left more than 100 affiliated doctors without access to patient files, schedules and billing for over a month. Its medical director said doctors had to rebuild files and no data had appeared online.","source":"RTS","url":"https://www.rts.ch/info/regions/vaud/2025/article/cyberattaque-a-lausanne-medecins-sans-acces-aux-dossiers-patients-28750319.html","archiveUrl":"https://web.archive.org/web/20261005161715/https://www.rts.ch/info/regions/vaud/2025/article/cyberattaque-a-lausanne-medecins-sans-acces-aux-dossiers-patients-28750319.html","theme":"other","status":"admitted","id":"CHE-S004","pageUrl":"https://healthrecordrights.com/real-cases/#CHE-S004","countryUrl":"https://healthrecordrights.com/brief/switzerland/","why":"When a shared system goes down, patients' records can be out of reach of their own doctors.","sourceType":"journalism","lang":"fr","providerName":"Vidymed","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"TWN","country":"Taiwan","date":"2025-03-06","headline":"Mackay Memorial Hospital apologises after ransomware attack that may have taken patient data","paraphrase":"After a ransomware attack, the hospital issued statements apologising and saying hackers may have stolen data while encrypting its systems. Millions of patient records were reportedly offered for sale; the ministry said the source still needed checking.","source":"Knews (知新聞)","url":"https://www.knews.com.tw/news/8A16D5DBB40F177A4BECE981103631A9","theme":"breach","status":"admitted","id":"TWN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#TWN-S001","countryUrl":"https://healthrecordrights.com/brief/taiwan/","why":"A hospital first said no patient data leaked, then said hackers may have taken data; patients were left to guard against fraud calls.","sourceType":"journalism","lang":"zh","providerName":"Mackay Memorial Hospital","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TWN","country":"Taiwan","date":"2026-06-15","headline":"Two men charged with buying hacked hospital patient records to resell online","paraphrase":"Prosecutors charged two men with paying cryptocurrency for a file of about 20,000 hospital patients' visit and health records stolen by hackers, then advertising hospital data for sale on a messaging app. Prosecutors asked for heavy sentences.","source":"Central News Agency (中央社)","url":"https://www.cna.com.tw/news/asoc/202606150041.aspx","theme":"sold_or_shared","status":"alleged","id":"TWN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#TWN-S002","countryUrl":"https://healthrecordrights.com/brief/taiwan/","why":"Once hospital records are stolen, they can be bought and resold cheaply; patients have no way to pull them back.","sourceType":"journalism","lang":"zh","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TWN","country":"Taiwan","date":"2026-09-21","headline":"Doctor charged with looking up other doctors' patients' records to win their business","paraphrase":"Prosecutors charged a hospital doctor with opening the records and contact details of three patients under other doctors' care, then texting them to criticise their doctors and urge them to switch to him. He has not been convicted.","source":"Central News Agency (中央社)","url":"https://www.cna.com.tw/news/asoc/202609210043.aspx","theme":"other","status":"alleged","id":"TWN-S003","pageUrl":"https://healthrecordrights.com/real-cases/#TWN-S003","countryUrl":"https://healthrecordrights.com/brief/taiwan/","why":"Staff access to records is meant for care; here prosecutors say it was used to contact and recruit patients.","sourceType":"journalism","lang":"zh","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"THA","country":"Thailand","date":"2025-08-02","headline":"Hospital fined after patient record pages sent for destruction leaked as snack bags","paraphrase":"A large private hospital hired a small contractor to destroy patient records but did not oversee the work. Over 1,000 record pages leaked and were reused as snack bags. The regulator fined the hospital and the contractor.","source":"Office of the Personal Data Protection Committee, via Government Public Relations Department","url":"https://www.prd.go.th/th/content/category/detail/id/39/iid/411380","theme":"breach","status":"finding","id":"THA-S001","pageUrl":"https://healthrecordrights.com/real-cases/#THA-S001","countryUrl":"https://healthrecordrights.com/brief/thailand/","why":"Paper records sent for disposal still hold patients' details; the regulator held the hospital responsible for its contractor.","sourceType":"regulator_decision","lang":"th","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"THA","country":"Thailand","date":"2026-08-29","headline":"Health ministry admits staff errors put false entries in citizens' national health app records","paraphrase":"Over 9,000 people flagged more than 24,000 entries in their national health app history as wrong. The ministry told a parliamentary committee about a quarter of checked entries were staff data-entry errors and others reflected performance targets, not care given.","source":"The Standard","url":"https://thestandard.co/moph-morprom-data-error/","theme":"record_wrong","status":"admitted","id":"THA-S002","pageUrl":"https://healthrecordrights.com/real-cases/#THA-S002","countryUrl":"https://healthrecordrights.com/brief/thailand/","why":"Entries for care never received can follow a patient into insurance claims and future treatment unless someone corrects them.","sourceType":"journalism","lang":"th","providerName":"Ministry of Public Health (Mor Prom app)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"THA","country":"Thailand","date":"2026-08-03","headline":"People with wrong entries in national health app say claims were blocked","paraphrase":"Affected people said their national health app history listed treatments they never had, one with 16 false entries. One said an insurance claim could not proceed. They want false entries deleted in writing and those responsible identified.","source":"The Active (Thai PBS)","url":"https://theactive.thaipbs.or.th/news/public-health-20260803-2","theme":"record_wrong","status":"alleged","id":"THA-S003","pageUrl":"https://healthrecordrights.com/real-cases/#THA-S003","countryUrl":"https://healthrecordrights.com/brief/thailand/","why":"When a record lists care that never happened, the patient can lose an insurance payout and has to fight to clear it.","sourceType":"journalism","lang":"th","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"THA","country":"Thailand","date":"2025-10-28","headline":"Patients moved after a hospital stopped public scheme care waited days for records","paraphrase":"After a private hospital stopped public scheme outpatients, transferred patients waited up to seven days for their medical history. The national insurer said it could not reach their data because the hospital was not linked to the national records exchange.","source":"Bangkok Post","url":"https://www.bangkokpost.com/thailand/general/3127437/patients-move-over-ct-fee","theme":"lost_between_providers","status":"alleged","id":"THA-S004","pageUrl":"https://healthrecordrights.com/real-cases/#THA-S004","countryUrl":"https://healthrecordrights.com/brief/thailand/","why":"When records stay locked in one hospital's system, patients changing hospitals can face gaps in ongoing care and prescriptions.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"THA","country":"Thailand","date":"2026-07-07","headline":"Cloud failure took patient records offline at public city hospitals, authority says","paraphrase":"The city's medical service department announced that a cloud infrastructure failure stopped the patient database, appointment and dispensing systems at 14 of its hospitals. Hospitals stayed open and switched to paper records, but services were delayed.","source":"Thairath","url":"https://www.thairath.co.th/news/local/bangkok/2944586","theme":"other","status":"admitted","id":"THA-S005","pageUrl":"https://healthrecordrights.com/real-cases/#THA-S005","countryUrl":"https://healthrecordrights.com/brief/thailand/","why":"When the record system fails, staff fall back to paper and patients wait longer; continuity depends on the system staying up.","sourceType":"journalism","lang":"th","providerName":"Medical Service Department, Bangkok Metropolitan Administration","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TLS","country":"Timor-Leste","date":"2026-03-20","headline":"Municipal health service admits running blood tests patients are never told about","paraphrase":"Since 2024 a municipal health service has screened every patient's blood sample for an extra test without telling them. Its director confirmed patients are not informed. Lawyers called the practice illegal and a breach of privacy and consent.","source":"Diligente","url":"https://www.diligenteonline.com/testes-de-vih-sem-consentimento-em-covalima-diretor-de-saude-admite-que-pacientes-nao-podem-saber-juristas-consideram-pratica-ilegal/","theme":"other","status":"admitted","id":"TLS-S001","pageUrl":"https://healthrecordrights.com/real-cases/#TLS-S001","countryUrl":"https://healthrecordrights.com/brief/timor-leste/","why":"Patients had test results created and held about them without being told or asked.","sourceType":"journalism","lang":"pt","providerName":"Serviço Municipal de Saúde de Covalima","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TON","country":"Tonga","date":"2025-06-20","headline":"Health ministry says ransomware locked the system holding every patient's history","paraphrase":"The health minister said a ransomware attack took down the national health information system, which holds patients' medical records and prescriptions. The ministry told people to bring their prescription cards because doctors could not open records.","source":"The Record from Recorded Future News","url":"https://therecord.media/tonga-ministry-of-health-hit-with-cyberattack","theme":"breach","status":"admitted","id":"TON-S001","pageUrl":"https://healthrecordrights.com/real-cases/#TON-S001","countryUrl":"https://healthrecordrights.com/brief/tonga/","why":"When the only copy of a nation's patient records is locked, doctors treat people without their history.","sourceType":"journalism","lang":"en","providerName":"Ministry of Health (Tonga)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TON","country":"Tonga","date":"2025-06-26","headline":"Patients asked to bring their own records after national health records breach","paraphrase":"The outlet reports growing concern about illegal access to health records after hackers breached the national system, while patients were told to bring any medical records they hold to hospital because staff were working from manual data.","source":"RNZ","url":"https://www.rnz.co.nz/news/pacific/565178/tonga-s-government-mum-on-health-cyber-breach","theme":"breach","status":"alleged","id":"TON-S002","pageUrl":"https://healthrecordrights.com/real-cases/#TON-S002","countryUrl":"https://healthrecordrights.com/brief/tonga/","why":"Patients were left carrying their own records while it was unclear who had accessed the stolen data.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TON","country":"Tonga","date":"2025-06-28","headline":"Minister says lapsed security licences and skipped backups exposed health records system","paraphrase":"Another government minister told the outlet that protective software licences on the health records system had expired and backup procedures were not followed properly before hackers broke in, leaving the records exposed.","source":"Tonga Independent News","url":"https://tongaindependent.com/nae-iai-nai-ha-taetokanga-o-hoko-ai-a-e-huu-kau-faihia-ki-he-sisitemi-a-e-potungaue-moui/","theme":"breach","status":"alleged","id":"TON-S004","pageUrl":"https://healthrecordrights.com/real-cases/#TON-S004","countryUrl":"https://healthrecordrights.com/brief/tonga/","why":"Patients depend on basic protections like current security software and working backups to keep records safe.","sourceType":"journalism","lang":"to","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TON","country":"Tonga","date":"2025-07-01","headline":"Confidential health information copied and leaked by hackers, outlet reports","paraphrase":"The outlet reports that confidential information from the national health system was copied and leaked by the criminals who encrypted it and demanded a ransom, which the government refused to pay.","source":"Matangi Tonga","url":"https://matangitonga.to/2025/07/01/cyber-criminals-leak-confidential-health-information","theme":"breach","status":"alleged","id":"TON-S005","pageUrl":"https://healthrecordrights.com/real-cases/#TON-S005","countryUrl":"https://healthrecordrights.com/brief/tonga/","why":"A leak of national health data puts every patient's private information at risk of misuse.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TTO","country":"Trinidad and Tobago","date":"2026-02-26","headline":"Health authority tells court it cannot find parts of a patient's records","paraphrase":"A man suing a public health authority over his hospital care was allowed to go ahead despite filing late. The authority told the High Court it could not locate some of his medical records.","source":"Trinidad and Tobago Guardian","url":"https://www.guardian.co.tt/news/judge-allows-negligence-case-against-swrha-to-proceed-after-limit-expires-6.2.2524354.01804956e9","theme":"other","status":"admitted","id":"TTO-S001","pageUrl":"https://healthrecordrights.com/real-cases/#TTO-S001","countryUrl":"https://healthrecordrights.com/brief/trinidad-and-tobago/","why":"When a hospital loses parts of a file, a patient trying to prove what happened has less to work with.","sourceType":"journalism","lang":"en","providerName":"South-West Regional Health Authority (SWRHA)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TTO","country":"Trinidad and Tobago","date":"2026-07-30","headline":"Lawyers say prison officials would not disclose a detained person's medical records","paraphrase":"Lawyers for a person in state detention told the High Court that prison officials decided not to disclose the medical records compiled during the detention, as part of a wider legal challenge.","source":"Trinidad and Tobago Guardian","url":"https://www.guardian.co.tt/news/soe-detainee-challenges-state-over-access-to-her-medical-treatment-6.2.2636067.417655f16f","theme":"access_refused","status":"alleged","id":"TTO-S002","pageUrl":"https://healthrecordrights.com/real-cases/#TTO-S002","countryUrl":"https://healthrecordrights.com/brief/trinidad-and-tobago/","why":"People held by the State still need their own medical records to get care and to challenge how they are treated.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TUN","country":"Tunisia","date":"2026-09-01","headline":"Official website lists disabled taxi licence holders, exposing their health status","paraphrase":"An investigative outlet found that a regional authority published online a named list of disabled people holding taxi licences, revealing health information about each person, while the national data protection regulator remains frozen.","source":"Nawaat","url":"https://nawaat.org/2026/09/01/%D8%B5%D9%81%D8%AD%D8%A7%D8%AA-%D9%88%D9%85%D9%88%D8%A7%D9%82%D8%B9-%D8%B1%D8%B3%D9%85%D9%8A%D8%A9-%D8%AA%D8%B9%D8%B7%D9%8A-%D8%A7%D9%84%D9%85%D8%AB%D8%A7%D9%84-%D9%81%D9%8A-%D8%A7%D9%86%D8%AA/","theme":"sold_or_shared","status":"alleged","id":"TUN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#TUN-S001","countryUrl":"https://healthrecordrights.com/brief/tunisia/","why":"When a public body posts a list tied to disability, a private health fact becomes public with no consent.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TUN","country":"Tunisia","date":"2026-06-25","headline":"Former detainee says his medical file was ignored after a prison transfer","paraphrase":"A man held in several prisons says that after he was moved to a new prison, staff ignored his medical file, and care arrangements agreed at earlier prisons were dropped.","source":"Inkyfada","url":"https://inkyfada.com/fr/2026/06/25/negligences-medicales-prisons-tunisiennes/","theme":"lost_between_providers","status":"self_reported","id":"TUN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#TUN-S002","countryUrl":"https://healthrecordrights.com/brief/tunisia/","why":"A medical file only protects a patient if the next place of care reads it.","sourceType":"journalism","lang":"fr","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TUN","country":"Tunisia","date":"2025-12-22","headline":"Patients carry paper files between hospitals whose computer systems do not connect","paraphrase":"A reporter found patients from inland regions carrying bags of scans and test results between hospitals, because regional and university hospital systems do not share data. An older patient said nothing moves unless he hands over paper in person.","source":"Ultra Tunisia","url":"https://ultratunisia.ultrasawt.com/%D8%A7%D9%84%D8%B5%D8%AD%D8%A9-%D9%81%D9%8A-%D8%AA%D9%88%D9%86%D8%B3-%D9%85%D8%B9%D8%A7%D9%86%D8%A7%D8%A9-%D8%AD%D9%82%D9%8A%D9%82%D9%8A%D8%A9-%D9%84%D9%84%D9%85%D8%B1%D8%B6%D9%89-%D9%88%D9%85%D8%B3%D8%A7%D8%B9%D9%8D-%D9%84%D9%84%D8%B1%D9%82%D9%85%D9%86%D8%A9/%D8%A3%D8%B3%D9%85%D8%A7%D8%A1-%D8%A7%D9%84%D8%A8%D9%83%D9%88%D8%B4/%D9%85%D8%AC%D8%AA%D9%85%D8%B9/%D8%AA%D9%82%D8%A7%D8%B1%DB%8C%D8%B1","theme":"lost_between_providers","status":"self_reported","id":"TUN-S003","pageUrl":"https://healthrecordrights.com/real-cases/#TUN-S003","countryUrl":"https://healthrecordrights.com/brief/tunisia/","why":"Without shared records, patients carry their own scans and results and must turn up in person to be seen.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TUR","country":"Turkey","date":"2026-06-23","headline":"Ministry inspectors penalise hospital staff who sold patient details to claims firms","paraphrase":"Staff at a public hospital copied patients' identity and contact details from the hospital information system and passed them to unlicensed insurance claims firms for commission. Health Ministry inspectors dismissed staff and suspended a doctor; a criminal investigation continues.","source":"Bizim Sakarya","url":"https://www.bizimsakarya.com.tr/seahta-veri-sizintisi-skandali-hasta-bilgilerini-satan-saglikcilara-ihrac-yagdi","theme":"sold_or_shared","status":"finding","id":"TUR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#TUR-S001","countryUrl":"https://healthrecordrights.com/brief/turkey/","why":"Staff with access to a hospital system sold patients' identity and contact details; logs exposed them.","sourceType":"journalism","lang":"tr","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TUR","country":"Turkey","date":"2026-04-04","headline":"Ransomware attack on a private hospital exposes highly sensitive patient data","paraphrase":"Attackers encrypted servers at a private hospital. The breach notice published by the data protection authority lists patients, staff and visitors among those affected, with data including sexual life and biometric details. The number affected was not yet known.","source":"T24","url":"https://t24.com.tr/gundem/ozel-hastaneye-siber-saldiri-hastalarin-cinsel-yasam-bilgileri-dahil-verileri-sizdirildi,1312070","theme":"breach","status":"admitted","id":"TUR-S002","pageUrl":"https://healthrecordrights.com/real-cases/#TUR-S002","countryUrl":"https://healthrecordrights.com/brief/turkey/","why":"The data protection authority published the breach; patients' most private details were reached.","sourceType":"journalism","lang":"tr","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TUR","country":"Turkey","date":"2026-08-03","headline":"Records of about 20,000 private hospital patients reportedly posted for free download","paraphrase":"A user claiming to hold a private hospital's database reportedly posted patients' identity numbers, addresses, diagnoses, prescriptions and insurance details online. The leak was unconfirmed and neither the hospital nor authorities had commented when reported.","source":"Pamukkale Haber","url":"https://www.pamukkalehaber.com/denizliyi-sarsan-iddia-hasta-verileri-internete-dustu","theme":"breach","status":"alleged","id":"TUR-S003","pageUrl":"https://healthrecordrights.com/real-cases/#TUR-S003","countryUrl":"https://healthrecordrights.com/brief/turkey/","why":"Identity numbers, diagnoses and prescriptions were reportedly shared online; the hospital had not commented.","sourceType":"journalism","lang":"tr","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TUR","country":"Turkey","date":"2026-09-09","headline":"Health services company tells regulator ransomware encrypted its systems; affected people still unknown","paraphrase":"A health services company notified the data protection authority that a ransomware attack encrypted its data over two days. It could not yet say which people or data categories were affected. The board ordered the notice published.","source":"Kişisel Verileri Koruma Kurumu (KVKK)","url":"https://www.kvkk.gov.tr/Icerik/8956/kamuoyu-duyurusu-veri-ihlali-bildirimi-ada-mert-saglik-hizmetleri-ticaret-as","theme":"breach","status":"admitted","id":"TUR-S004","pageUrl":"https://healthrecordrights.com/real-cases/#TUR-S004","countryUrl":"https://healthrecordrights.com/brief/turkey/","why":"Patients cannot act on a breach when even the provider cannot yet say whose records or which data were hit.","sourceType":"regulator_decision","lang":"tr","providerName":"Ada Mert Sağlık Hizmetleri Ticaret AŞ","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TKM","country":"Turkmenistan","date":"2026-07-20","headline":"Patients say state health officials demand bribes to sign final medical reports","paraphrase":"Patients seeking approval for treatment abroad say officials asked for 5,000 dollars before signing the final medical conclusion they need, and that people who do not pay can wait years for the document.","source":"Turkmen.news","url":"https://turkmen.news/2026/07/20/chinovniki-turkmenskogo-minzdrava-vymogayut-vzyatki-u-tyazhelobolnyh-pacientov-i-ignoriruyut-zaprosy-bolnic/","theme":"access_delay_or_cost","status":"alleged","id":"TKM-S001","pageUrl":"https://healthrecordrights.com/real-cases/#TKM-S001","countryUrl":"https://healthrecordrights.com/brief/turkmenistan/","why":"A patient's own final medical conclusion is reportedly held back unless a large bribe is paid.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"TKM","country":"Turkmenistan","date":"2025-08-14","headline":"Teachers say medical check certificates are sold without anyone checking results","paraphrase":"Teachers describe paying a bribe to have their required medical record books filled in, and one says a clinic doctor took samples but issued a certificate of normal results two hours later without checking them.","source":"Chronicles of Turkmenistan (Хроника Туркменистана)","url":"https://www.hronikatm.com/2025/08/teachers-in-turkmenabat-receive-certificates-of-medical-examination-for-bribes/","theme":"record_wrong","status":"alleged","id":"TKM-S002","pageUrl":"https://healthrecordrights.com/real-cases/#TKM-S002","countryUrl":"https://healthrecordrights.com/brief/turkmenistan/","why":"Health records that certify normal results without any check cannot be trusted by patients or employers.","sourceType":"journalism","lang":"ru","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"UGA","country":"Uganda","date":"2026-02-25","headline":"High Court orders charity clinic to pay damages over wrong test result on file","paraphrase":"A clinic recorded a wrong test result for a man that later tests did not support, and acted on it for years. The error surfaced when he applied for a benefit. The High Court found negligence and awarded damages.","source":"Daily Express (Uganda)","url":"https://dailyexpress.co.ug/2026/02/25/court-orders-taso-to-pay-shs190m-to-man-wrongly-put-on-arvs/","theme":"record_wrong","status":"finding","id":"UGA-S001","pageUrl":"https://healthrecordrights.com/real-cases/#UGA-S001","countryUrl":"https://healthrecordrights.com/brief/uganda/","why":"A wrong result left uncorrected in a patient's record drove years of care decisions; the court held the clinic liable.","sourceType":"journalism","lang":"en","providerName":"TASO","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"UGA","country":"Uganda","date":"2026-08-05","headline":"Patient says hospital gave his test results to security officers, not to him","paraphrase":"A man brought to a hospital under guard says staff passed his test results to the officers holding him and never gave or explained them to him. He also says the hospital recorded him under another name.","source":"The Investigator News","url":"https://theinvestigatornews.com/2026/08/i-was-kidnapped-and-operated-on-journalist-gideon-tugume-files-suit-over-alleged-torture-and-illegal-detention-accuses-kisubi-hospital-of-giving-his-hiv-results-to-updf-without-consent/","theme":"sold_or_shared","status":"alleged","id":"UGA-S002","pageUrl":"https://healthrecordrights.com/real-cases/#UGA-S002","countryUrl":"https://healthrecordrights.com/brief/uganda/","why":"Patients own their results; handing them to third parties without consent breaks confidentiality and denies the patient access.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"UKR","country":"Ukraine","date":"2026-08-17","headline":"Court voids military fitness ruling after commission could not produce examination records","paraphrase":"A man said he was never examined, yet a military medical commission certified him fit for service. Asked by the court for the examination file and doctors' findings, the commission produced only the certificate, so the court annulled it.","source":"Sudovo-yurydychna hazeta (sud.ua)","url":"https://sud.ua/uk/news/sudova-praktyka/369460-vlk-na-paperi-cholovika-vyznaly-prydatnym-ale-ttsk-ne-nadav-sudu-dokumentiv-pro-medohliad","theme":"record_wrong","status":"finding","id":"UKR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#UKR-S001","countryUrl":"https://healthrecordrights.com/brief/ukraine/","why":"A record entry with no examination behind it decided a person's future; the court demanded the underlying file.","sourceType":"journalism","lang":"uk","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"UKR","country":"Ukraine","date":"2026-02-02","headline":"National health service ends contracts with clinics that falsified patients' electronic records","paraphrase":"The national health service said some clinics put inflated or invented entries into patients' electronic records to raise payments, and it ended contracts with several. Patients have reported finding visits in their records that never happened.","source":"RBC-Ukraine","url":"https://www.rbc.ua/rus/news/okremimi-likarnyami-nszu-rozirvala-dogovori-1770013744.html","theme":"record_wrong","status":"finding","id":"UKR-S002","pageUrl":"https://healthrecordrights.com/real-cases/#UKR-S002","countryUrl":"https://healthrecordrights.com/brief/ukraine/","why":"False entries stay in a patient's lifelong electronic record and can be hard to correct.","sourceType":"journalism","lang":"uk","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"UKR","country":"Ukraine","date":"2026-03-26","headline":"Family doctor held over 1,731 patient sign-ups allegedly made without people's knowledge","paraphrase":"Investigators say a family doctor registered 1,731 patient declarations in the national e-health system without people's knowledge, using altered names, birth dates and addresses, to claim state payments for care never given.","source":"StopCor","url":"https://www.stopcor.org/ukr/section-uanews/news-medposlugi-lishe-na-paperi-likarka-otrimala-miljoni-za-fejkovi-deklaratsii-26-03-2026.html","theme":"record_wrong","status":"alleged","id":"UKR-S003","pageUrl":"https://healthrecordrights.com/real-cases/#UKR-S003","countryUrl":"https://healthrecordrights.com/brief/ukraine/","why":"People can be enrolled with a doctor they never met, with their details altered in the national record.","sourceType":"journalism","lang":"uk","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"UKR","country":"Ukraine","date":"2024-12-16","headline":"Women found clinic visits they never made written into their electronic records","paraphrase":"Prosecutors named a doctor as a suspect for entering at least 22 false appointment records over two years for women who had never met him. The women discovered the entries themselves and went to police.","source":"KP.UA","url":"https://kp.ua/ua/life/a702092-pju-vdoma-kavu-a-likar-pishe-shcho-ja-u-noho-na-prijomi-chim-zahrozhujut-fejkovi-zapisi-v-helsi","theme":"record_wrong","status":"alleged","id":"UKR-S004","pageUrl":"https://healthrecordrights.com/real-cases/#UKR-S004","countryUrl":"https://healthrecordrights.com/brief/ukraine/","why":"Invented appointments sit in a patient's record unless the patient checks and complains.","sourceType":"journalism","lang":"uk","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"UKR","country":"Ukraine","date":"2026-10-01","headline":"Man says health facility withheld some of late mother's records until ombudsman intervened","paraphrase":"A man asked a health facility for copies of medical records about his mother's death and says he received only some. After the human rights ombudsman wrote to the facility, it sent the requested documents electronically.","source":"Уповноважений Верховної Ради України з прав людини (Ukrainian Parliament Commissioner for Human Rights)","url":"https://ombudsman.gov.ua/index.php/news_details/medichni-dokumenti-pro-smert-materi-ne-nadali-povnistyu-pislya-reaguvannya-ombudsmana-cholovik-otrimav-usi-zapituvani-dokumenti","theme":"access_refused","status":"alleged","id":"UKR-S005","pageUrl":"https://healthrecordrights.com/real-cases/#UKR-S005","countryUrl":"https://healthrecordrights.com/brief/ukraine/","why":"Families may need a late relative's full records, and partial disclosure can block them until an outside body steps in.","sourceType":"regulator_decision","lang":"uk","lastVerified":"2026-10-04","addedOn":"2026-10-04","inLanguage":"en"},{"iso3":"ARE","country":"United Arab Emirates","date":"2025-05-09","headline":"Regulator closes four clinics that wrote visits that never happened into medical files","paraphrase":"The health regulator closed four facilities that sold sick leave over a messaging app, collecting ID photos and health details, then recorded visits that never happened in people's medical files and forged consent signatures.","source":"Emarat Al Youm","url":"https://www.emaratalyoum.com/local-section/health/2025-05-09-1.1943163","archiveUrl":"https://web.archive.org/web/20261005154100/https://www.emaratalyoum.com/local-section/health/2025-05-09-1.1943163","theme":"record_wrong","status":"finding","id":"ARE-S002","pageUrl":"https://healthrecordrights.com/real-cases/#ARE-S002","countryUrl":"https://healthrecordrights.com/brief/united-arab-emirates/","why":"A medical file is only trustworthy if every entry reflects care that actually took place.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"ARE","country":"United Arab Emirates","date":"2026-03-27","headline":"Regulator shuts five health facilities after finding manipulated medical data","paraphrase":"The emirate's health regulator closed five facilities and suspended staff pending referral to prosecutors. Inspections found sick notes issued without examining patients and manipulation of medical data, among other licensing violations.","source":"Emarat Al Youm","url":"https://www.emaratalyoum.com/local-section/health/2026-03-27-1.2029307","archiveUrl":"https://web.archive.org/web/20261005154206/https://www.emaratalyoum.com/local-section/health/2026-03-27-1.2029307","theme":"record_wrong","status":"finding","id":"ARE-S003","pageUrl":"https://healthrecordrights.com/real-cases/#ARE-S003","countryUrl":"https://healthrecordrights.com/brief/united-arab-emirates/","why":"Records altered by a provider can follow patients into later care and insurance decisions.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GBR","country":"United Kingdom","date":"2025-12-16","headline":"GP surgery sent 23 years of records to an insurer that asked for five","paraphrase":"An insurer asked for five years of records, to go to the patient first for review. The surgery emailed 23 years straight to the insurer. The patient said their payout was cut. The ICO issued a reprimand.","source":"Information Commissioner's Office","url":"https://ico.org.uk/action-weve-taken/enforcement/2025/12/staines-health-group/","archiveUrl":"https://web.archive.org/web/20261005170217/https://ico.org.uk/action-weve-taken/enforcement/2025/12/staines-health-group/","theme":"sold_or_shared","status":"finding","id":"GBR-S001","pageUrl":"https://healthrecordrights.com/real-cases/#GBR-S001","countryUrl":"https://healthrecordrights.com/brief/united-kingdom/","why":"Shows a practice can over-share a full record with a third party, bypassing the patient's own review.","sourceType":"regulator_decision","lang":"en","providerName":"Staines Health Group","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GBR","country":"United Kingdom","date":"2025-03-27","headline":"Regulator fines NHS software supplier after hackers took data on 79,404 people","paraphrase":"Hackers entered a supplier's health systems through an account without multi-factor authentication. Data on 79,404 people was taken, including how to enter the homes of 890 people receiving care at home. The ICO fined the supplier £3.07m.","source":"Information Commissioner's Office","url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/03/software-provider-fined-3m-following-2022-ransomware-attack/","archiveUrl":"https://web.archive.org/web/20261005170235/https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/03/software-provider-fined-3m-following-2022-ransomware-attack/","theme":"breach","status":"finding","id":"GBR-S002","pageUrl":"https://healthrecordrights.com/real-cases/#GBR-S002","countryUrl":"https://healthrecordrights.com/brief/united-kingdom/","why":"Records held by a supplier, not the clinic, can be the weak point; staff also lost access to patient records.","sourceType":"regulator_decision","lang":"en","providerName":"Advanced Computer Software Group Ltd","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GBR","country":"United Kingdom","date":"2024-12-13","headline":"Hospital trust missed the legal deadline on nearly a third of access requests","paraphrase":"Over a year, a large hospital trust failed to answer 32% of people's requests for their own personal data within one month. It could not say how many requests were in its backlog. The ICO issued a reprimand.","source":"Information Commissioner's Office","url":"https://ico.org.uk/action-weve-taken/enforcement/2024/12/united-lincolnshire-teaching-hospitals-nhs-trust/","archiveUrl":"https://web.archive.org/web/20261005170253/https://ico.org.uk/action-weve-taken/enforcement/2024/12/united-lincolnshire-teaching-hospitals-nhs-trust/","theme":"access_delay_or_cost","status":"finding","id":"GBR-S003","pageUrl":"https://healthrecordrights.com/real-cases/#GBR-S003","countryUrl":"https://healthrecordrights.com/brief/united-kingdom/","why":"Patients have a one-month right to copies of their data; a backlog means many wait longer.","sourceType":"regulator_decision","lang":"en","providerName":"United Lincolnshire Teaching Hospitals NHS Trust","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GBR","country":"United Kingdom","date":"2025-05-02","headline":"Nearly one in four adults in England found errors in their medical records","paraphrase":"A survey of 1,800 adults for the patient watchdog found 23% had noticed mistakes or gaps in their NHS records, including wrong personal details, wrong medication and conditions they never had. Most said the errors caused problems.","source":"Pharmacy Business","url":"https://www.pharmacy.biz/errors-medical-records-healthwatch-england/","archiveUrl":"https://web.archive.org/web/20261005170319/https://www.pharmacy.biz/errors-medical-records-healthwatch-england/","theme":"record_wrong","status":"self_reported","id":"GBR-S005","pageUrl":"https://healthrecordrights.com/real-cases/#GBR-S005","countryUrl":"https://healthrecordrights.com/brief/united-kingdom/","why":"Wrong or missing entries follow patients into appointments, prescriptions and benefit claims, and are hard to fix.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GBR","country":"United Kingdom","date":"2026-05-27","headline":"Whistleblower says new hospital record system loses referrals and patient information","paraphrase":"A clinician at a London hospital trust said its new electronic record system sent referrals to the wrong place, held missing or unreliable information and left patients lost to follow-up. The trust said the rollout caused a number of issues.","source":"LBC","url":"https://www.lbc.co.uk/article/nhs-east-london-whistleblower-it-system-patients-5HjdZgg_2/","archiveUrl":"https://web.archive.org/web/20261005170424/https://www.lbc.co.uk/article/nhs-east-london-whistleblower-it-system-patients-5HjdZgg_2/","theme":"lost_between_providers","status":"alleged","id":"GBR-S006","pageUrl":"https://healthrecordrights.com/real-cases/#GBR-S006","countryUrl":"https://healthrecordrights.com/brief/united-kingdom/","why":"When referrals vanish inside a record system, patients can wait for results and follow-up that never come.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GBR","country":"United Kingdom","date":"2026-07-12","headline":"Scottish health boards recorded over 5,000 patient data breaches in four years","paraphrase":"Freedom of information requests found Scotland's health boards logged more than 5,000 data breaches over four years, including staff sharing confidential patient information and records wrongly accessed. At least 182 staff were disciplined and police were informed six times.","source":"The Ferret","url":"https://www.theferret.scot/nhs-scotland-data-breaches/","archiveUrl":"https://web.archive.org/web/20261005170526/https://www.theferret.scot/nhs-scotland-data-breaches/","theme":"breach","status":"admitted","id":"GBR-S007","pageUrl":"https://healthrecordrights.com/real-cases/#GBR-S007","countryUrl":"https://healthrecordrights.com/brief/united-kingdom/","why":"Patients trust health boards to keep records confidential; thousands of breaches and staff misuse show that trust is often broken.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-04","addedOn":"2026-10-04","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"GBR","country":"United Kingdom","date":"2026-06-08","headline":"Hospital trust in England confirms thousands of patients' test results stolen in supplier hack","paraphrase":"An NHS hospital trust confirmed that thousands of patient records, including test results, were stolen from a third-party testing provider's systems. The supplier said the data, possibly including names, NHS numbers and postcodes, was published on the dark web.","source":"BBC News","url":"https://www.bbc.com/news/articles/c072797rlx5o","archiveUrl":"https://web.archive.org/web/20261005170614/https://www.bbc.com/news/articles/c072797rlx5o","theme":"breach","status":"admitted","id":"GBR-S008","pageUrl":"https://healthrecordrights.com/real-cases/#GBR-S008","countryUrl":"https://healthrecordrights.com/brief/united-kingdom/","why":"Test results and identifiers held by an outside lab supplier were stolen and posted online, leaving patients exposed.","sourceType":"journalism","lang":"en","providerName":"Mid and South Essex NHS Foundation Trust","lastVerified":"2026-10-04","addedOn":"2026-10-04","archivedOn":"2026-10-05","inLanguage":"en"},{"iso3":"USA","country":"United States","date":"2025-12-16","headline":"Six requests and more than a year before a patient got his records","paraphrase":"A patient made six requests for his health information and waited more than a year to receive it. The regulator proposed a penalty; the provider settled before a hearing and paid $112,500.","source":"U.S. Department of Health and Human Services, Office for Civil Rights","url":"https://www.hhs.gov/press-room/ocr-settles-with-concentra.html","theme":"access_delay_or_cost","status":"finding","id":"USA-S002","pageUrl":"https://healthrecordrights.com/real-cases/#USA-S002","countryUrl":"https://healthrecordrights.com/brief/united-states/","why":"Shows how many times a patient may have to ask, and how long enforcement can take, before records are released.","sourceType":"regulator_decision","lang":"en","providerName":"Concentra, Inc.","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"USA","country":"United States","date":"2025-09-30","headline":"Care provider posted patient stories online without written permission","paraphrase":"A complaint said a group of care facilities put a patient's name, photo and care details on its website as a success story. The regulator found the same had happened to 150 patients without valid written authorization.","source":"U.S. Department of Health and Human Services, Office for Civil Rights","url":"https://www.hhs.gov/press-room/ocr-settles-hipaa-with-cadia-healthcare-facilities.html","theme":"sold_or_shared","status":"finding","id":"USA-S003","pageUrl":"https://healthrecordrights.com/real-cases/#USA-S003","countryUrl":"https://healthrecordrights.com/brief/united-states/","why":"A provider used patients' names, photos and care details for marketing without the written consent the law requires.","sourceType":"regulator_decision","lang":"en","providerName":"Cadia Healthcare Facilities","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"USA","country":"United States","date":"2025-01-15","headline":"Patient asked by mail, phone and portal, then waited about nine months","paraphrase":"A patient asked a health system for his medical records by mail, telephone and its patient portal. He received them about nine months later, only after the regulator opened an investigation. The system paid $60,000.","source":"U.S. Department of Health and Human Services, Office for Civil Rights","url":"https://www.hhs.gov/about/news/2025/01/15/hhs-office-civil-rights-settles-hipaa-case-against-memorial-healthcare-system-over-patient-access-records.html","theme":"access_delay_or_cost","status":"finding","id":"USA-S004","pageUrl":"https://healthrecordrights.com/real-cases/#USA-S004","countryUrl":"https://healthrecordrights.com/brief/united-states/","why":"Using every channel a hospital offers, including its portal, did not get this patient his records on time.","sourceType":"regulator_decision","lang":"en","providerName":"South Broward Hospital District (Memorial Healthcare System)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"USA","country":"United States","date":"2025-01-24","headline":"Insurer confirms health data of about 190 million Americans hit in one attack","paraphrase":"A ransomware attack on a claims-processing company exposed names, ID numbers, insurance details and medical information such as test results and medications. Its parent company raised the count to about 190 million people. Attackers used a stolen credential.","source":"TechCrunch","url":"https://techcrunch.com/2025/01/24/unitedhealth-confirms-190-million-americans-affected-by-change-healthcare-data-breach/","theme":"breach","status":"admitted","id":"USA-S005","pageUrl":"https://healthrecordrights.com/real-cases/#USA-S005","countryUrl":"https://healthrecordrights.com/brief/united-states/","why":"A claims processor most patients never deal with directly held medical and insurance details on most of the country.","sourceType":"journalism","lang":"en","providerName":"Change Healthcare (UnitedHealth Group)","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"USA","country":"United States","date":"2024-11-18","headline":"Patient asked for her records in writing and waited seven months for them","paraphrase":"A patient made a written request for her records, went to collect them, then phoned many times. A county clinic sent them seven months later, after the regulator opened an investigation. The regulator imposed a $100,000 penalty.","source":"U.S. Department of Health and Human Services, Office for Civil Rights","url":"https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/rio-hondo-npd/index.html","theme":"access_delay_or_cost","status":"finding","id":"USA-S006","pageUrl":"https://healthrecordrights.com/real-cases/#USA-S006","countryUrl":"https://healthrecordrights.com/brief/united-states/","why":"She went in person, called repeatedly and still waited 156 days; the records came only after the regulator stepped in.","sourceType":"regulator_decision","lang":"en","providerName":"Rio Hondo Community Mental Health Center (County of Los Angeles)","lastVerified":"2026-10-03","addedOn":"2026-10-03","inLanguage":"en"},{"iso3":"USA","country":"United States","date":"2025-03-06","headline":"Patient's full records arrived more than two years after her representative first asked","paraphrase":"A patient's representative asked an academic health center for her records. Part came quickly; the rest arrived more than two years later, after two complaints to the regulator. The center did not contest a $200,000 penalty.","source":"U.S. Department of Health and Human Services, Office for Civil Rights","url":"https://www.hhs.gov/about/news/2025/03/06/hhs-office-civil-rights-imposes-200000-penalty-against-oregon-health-science-university-failure-provide-timely-access-patient-records.html","theme":"access_delay_or_cost","status":"finding","id":"USA-S007","pageUrl":"https://healthrecordrights.com/real-cases/#USA-S007","countryUrl":"https://healthrecordrights.com/brief/united-states/","why":"Handing record requests to a contractor does not pause the clock; the hospital stays responsible for the delay.","sourceType":"regulator_decision","lang":"en","providerName":"Oregon Health & Science University","lastVerified":"2026-10-03","addedOn":"2026-10-03","inLanguage":"en"},{"iso3":"USA","country":"United States","date":"2025-04","headline":"Second round of refunds after counseling service shared users' health answers with advertisers","paraphrase":"The regulator's administrator began a second round of payments, over $2.6 million, to customers of an online counseling service. Under a 2023 order, the company paid $7.8 million for sharing email addresses and health questionnaire answers with advertisers.","source":"U.S. Federal Trade Commission","url":"https://www.ftc.gov/enforcement/refunds/betterhelp-refunds","theme":"sold_or_shared","status":"finding","id":"USA-S008","pageUrl":"https://healthrecordrights.com/real-cases/#USA-S008","countryUrl":"https://healthrecordrights.com/brief/united-states/","why":"Answers people gave to sign up for care were passed to advertising platforms, against the service's own privacy promise.","sourceType":"regulator_decision","lang":"en","providerName":"BetterHelp, Inc.","lastVerified":"2026-10-03","addedOn":"2026-10-03","inLanguage":"en"},{"iso3":"USA","country":"United States","date":"2025-07-01","headline":"Health website shared article titles that could reveal a reader's diagnosis","paraphrase":"The state found a health information website sent identifiers and the titles of articles readers viewed to advertisers, ignored opt-out requests, and ran a consent banner that did not stop tracking. It paid $1.55 million.","source":"California Department of Justice, Office of the Attorney General","url":"https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155","theme":"sold_or_shared","status":"finding","id":"USA-S009","pageUrl":"https://healthrecordrights.com/real-cases/#USA-S009","countryUrl":"https://healthrecordrights.com/brief/united-states/","why":"Reading about a condition can expose it: the site passed identifiers and article titles to advertisers and ignored opt-outs.","sourceType":"regulator_decision","lang":"en","providerName":"Healthline Media LLC","lastVerified":"2026-10-03","addedOn":"2026-10-03","inLanguage":"en"},{"iso3":"USA","country":"United States","date":"2026-07-29","headline":"Federal and state regulators sue telehealth company over sharing health details with advertisers","paraphrase":"A federal regulator, joined by two states, alleges a telehealth company passed customers' health information to advertising platforms through customer lists and website tracking, despite privacy promises. The case is pending in federal court.","source":"U.S. Federal Trade Commission","url":"https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-states-act-against-hims-hers-deceptive-unlawful-privacy-practices","theme":"sold_or_shared","status":"alleged","id":"USA-S011","pageUrl":"https://healthrecordrights.com/real-cases/#USA-S011","countryUrl":"https://healthrecordrights.com/brief/united-states/","why":"Health details typed into an online intake form allegedly reached ad platforms despite promises of patient privacy.","sourceType":"regulator_decision","lang":"en","lastVerified":"2026-10-03","addedOn":"2026-10-03","inLanguage":"en"},{"iso3":"USA","country":"United States","date":"2026-08-19","headline":"Health records company confirms data of 3.75 million patients stolen in breach","paraphrase":"A company storing electronic medical records for healthcare providers told federal regulators hackers stole personal information and medical records of more than 3.75 million people, including Social Security numbers, health information, ID numbers and banking details.","source":"Yahoo News (TechCrunch)","url":"https://www.yahoo.com/news/us/articles/carecloud-confirms-3-7m-patients-130410667.html","theme":"breach","status":"admitted","id":"USA-S012","pageUrl":"https://healthrecordrights.com/real-cases/#USA-S012","countryUrl":"https://healthrecordrights.com/brief/united-states/","why":"A single breach at a records vendor can expose the medical and financial details of millions of patients at once.","sourceType":"journalism","lang":"en","providerName":"CareCloud","lastVerified":"2026-10-04","addedOn":"2026-10-04","inLanguage":"en"},{"iso3":"USA","country":"United States","date":"2026-08-12","headline":"Billing software vendor confirms theft of insurance and claims data for 3.8 million people","paraphrase":"Hackers copied insurance policy numbers, claims and benefits data, medical record numbers and Social Security numbers from a health billing software vendor. The vendor reported 3.8 million people affected to federal regulators about nine months after discovering the intrusion.","source":"Insurance Business","url":"https://www.insurancebusinessmag.com/us/news/benefits/health-tech-vendor-breach-hits-3-8-million-patients-benefits-data-585836.aspx","theme":"breach","status":"admitted","id":"USA-S014","pageUrl":"https://healthrecordrights.com/real-cases/#USA-S014","countryUrl":"https://healthrecordrights.com/brief/united-states/","why":"Patient data held by little-known vendors can be stolen, and patients may not hear about it for many months.","sourceType":"journalism","lang":"en","providerName":"Unlimited Technology Systems, LLC","lastVerified":"2026-10-04","addedOn":"2026-10-04","inLanguage":"en"},{"iso3":"URY","country":"Uruguay","date":"2025-12-14","headline":"Health worker says clinical records are completed afterwards to shield doctors from lawsuits","paraphrase":"An anonymous staff member at a private health provider told a newspaper that records are often filled in after care and adjusted, so complications are minimised or left out of the patient's record.","source":"Grupo R Multimedio (La R)","url":"https://grupormultimedio.com/se-manipulan-historias-clinicas-para-proteger-a-medicos-y-evitar-juicios-un-funcionario-del-casmu-hablo-bajo-proteccion-de-identidad-id179320/","theme":"record_wrong","status":"alleged","id":"URY-S002","pageUrl":"https://healthrecordrights.com/real-cases/#URY-S002","countryUrl":"https://healthrecordrights.com/brief/uruguay/","why":"If records are written after the fact, patients cannot rely on them to know what happened in their care.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"VEN","country":"Venezuela","date":"2026-07-21","headline":"After the earthquakes, families found hospital patient lists with blank or partial names","paraphrase":"Relatives searching for people after the earthquakes say hospital patient lists held entries that were not names at all, only question marks or single letters, and that some people lost all trace during transfers between hospitals.","source":"El País","url":"https://elpais.com/america/2026-07-21/la-angustia-por-los-desaparecidos-tras-los-terremotos-en-venezuela-se-perdio-la-huella-de-mi-madre.html","theme":"record_wrong","status":"alleged","id":"VEN-S001","pageUrl":"https://healthrecordrights.com/real-cases/#VEN-S001","countryUrl":"https://healthrecordrights.com/brief/venezuela/","why":"When admission records carry no usable name, relatives cannot find a patient and the patient's own record is lost.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"VEN","country":"Venezuela","date":"2026-07-12","headline":"Earthquake survivors taken to hospitals never appeared in admission records, families say","paraphrase":"Families say people rescued alive and taken by ambulance were never recorded at any hospital; one was possibly admitted under another name. They say no public, unified register of those rescued in the first hours existed.","source":"El Pitazo","url":"https://elpitazo.net/regiones/buscarlos-sin-descanso-el-rastro-perdido-de-personas-vistas-con-vida-despues-de-los-terremotos/","theme":"lost_between_providers","status":"alleged","id":"VEN-S002","pageUrl":"https://healthrecordrights.com/real-cases/#VEN-S002","countryUrl":"https://healthrecordrights.com/brief/venezuela/","why":"A patient moved between hospitals without a record can vanish from the system, leaving no trail for care or family.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"VEN","country":"Venezuela","date":"2026-06-29","headline":"Official register of injured earthquake patients had dead links and unanswered phone lines","paraphrase":"The government announced a website listing patients treated in eleven hospitals after the earthquakes. The outlet found its links and phone numbers led nowhere, and the list could only be searched by exact name or ID number.","source":"El Nacional","url":"https://www.elnacional.com/2026/06/regimen-habilito-pagina-de-registro-de-heridos-que-no-funciona/","theme":"access_refused","status":"alleged","id":"VEN-S003","pageUrl":"https://healthrecordrights.com/real-cases/#VEN-S003","countryUrl":"https://healthrecordrights.com/brief/venezuela/","why":"A patient register only helps if people can reach it; broken links and phones left families without answers.","sourceType":"journalism","lang":"es","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"VNM","country":"Vietnam","date":"2025-10-05","headline":"Hospital systems hit by attackers; patient data offered for sale on hacker forums","paraphrase":"The report lists several attacks on major hospitals, including encrypted servers, ransom demands and patient and staff records advertised for sale on cybercrime forums. It reports no statement from the hospitals and no penalty.","source":"VietNamNet","url":"https://vietnamnet.vn/en/major-hospitals-hit-by-cyberattacks-patient-data-sold-on-hacker-forums-2449058.html","theme":"breach","status":"alleged","id":"VNM-S001","pageUrl":"https://healthrecordrights.com/real-cases/#VNM-S001","countryUrl":"https://healthrecordrights.com/brief/vietnam/","why":"Patients are rarely told when a hospital system is breached, so they cannot protect themselves from misuse of their records.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"VNM","country":"Vietnam","date":"2026-05-23","headline":"Police cybersecurity unit warns of two attacks on hospital data in one month","paraphrase":"A police cybersecurity official said attackers hit hospital or health ministry data twice in one month, threatening to expose details of thousands of doctors and patients, including diagnostic imaging, and warned that health sector security is weak.","source":"Tuoi Tre","url":"https://tuoitre.vn/canh-bao-tinh-trang-tin-tac-tan-cong-du-lieu-so-cua-benh-vien-lo-thong-tin-bac-si-va-nguoi-benh-2026052321424194.htm","theme":"breach","status":"alleged","id":"VNM-S002","pageUrl":"https://healthrecordrights.com/real-cases/#VNM-S002","countryUrl":"https://healthrecordrights.com/brief/vietnam/","why":"An attack on electronic records can expose patients and leave doctors without the record when care depends on it.","sourceType":"journalism","lang":"vi","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"VNM","country":"Vietnam","date":"2025-08-20","headline":"Patients get sales calls after hospital visits as their data is sold online","paraphrase":"Patients described being phoned with sales offers soon after hospital discharge. A security expert found patient names, phone numbers and medical history sold cheaply on a messaging app. Some hospitals stayed silent about attacks, the report says.","source":"VietTimes","url":"https://viettimes.vn/lo-hong-so-hoa-benh-vien-khi-du-lieu-benh-nhan-bi-bien-thanh-mon-hang-post188681.html","theme":"sold_or_shared","status":"alleged","id":"VNM-S003","pageUrl":"https://healthrecordrights.com/real-cases/#VNM-S003","countryUrl":"https://healthrecordrights.com/brief/vietnam/","why":"When record details leak from a hospital, patients become targets for sellers and scams and do not know where the leak came from.","sourceType":"journalism","lang":"vi","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"VNM","country":"Vietnam","date":"2025-06-10","headline":"Patients say doctors posted their consultations and procedures online without clear consent","paraphrase":"Two adult patients said clinics posted images or livestreamed their consultations for promotion without clear consent; one learned colleagues had seen the video. A city health department head condemned the practice, citing confidentiality rules.","source":"Sai Gon Giai Phong","url":"https://www.sggp.org.vn/dang-tai-hinh-anh-nguoi-benh-len-mang-xa-hoi-vi-pham-quyen-ca-nhan-va-bi-mat-doi-tu-post798808.html","theme":"sold_or_shared","status":"alleged","id":"VNM-S004","pageUrl":"https://healthrecordrights.com/real-cases/#VNM-S004","countryUrl":"https://healthrecordrights.com/brief/vietnam/","why":"Images and videos taken during care are part of the record; posting them publicly can expose a patient to colleagues and strangers.","sourceType":"journalism","lang":"vi","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"VNM","country":"Vietnam","date":"2026-10-01","headline":"Provincial health department finds recurring errors and gaps in hospital medical records","paraphrase":"A provincial health department official reported common record faults found across facilities: diagnoses not updated, test results not assessed, sections that contradict each other and orders with no clear link to the patient's condition. No facility was named.","source":"Bao Dong Nai","url":"https://baodongnai.com.vn/xa-hoi/202610/chan-chinh-chi-dinh-can-lam-sang-ke-don-thuoc-va-chat-luong-ho-so-benh-an-7fb1fc2/","theme":"record_wrong","status":"finding","id":"VNM-S005","pageUrl":"https://healthrecordrights.com/real-cases/#VNM-S005","countryUrl":"https://healthrecordrights.com/brief/vietnam/","why":"A record that is out of date or inconsistent can mislead the next doctor and weaken a patient's insurance or complaint.","sourceType":"journalism","lang":"vi","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"YEM","country":"Yemen","date":"2026-05-14","headline":"Report says Houthi security units collect daily patient data from hospitals","paraphrase":"Security sources told the outlet that hospitals and clinics in Houthi-held areas were linked to a new security unit and pressed to hand over daily details of patients and cases, building a health database on residents.","source":"Al-Ain News","url":"https://al-ain.com/article/new-houthi-policy-il-persons","theme":"sold_or_shared","status":"alleged","id":"YEM-S001","pageUrl":"https://healthrecordrights.com/real-cases/#YEM-S001","countryUrl":"https://healthrecordrights.com/brief/yemen/","why":"Patients in Houthi-held areas may have their hospital records passed to intelligence services without consent.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"YEM","country":"Yemen","date":"2026-02-18","headline":"Faulty hospital lab machine gave a patient a dangerously wrong test result","paraphrase":"A relative says a hospital lab recorded a test value far outside the normal range. A doctor doubted it and ordered a retest elsewhere, which came back normal, pointing to a broken machine.","source":"Crater Sky, via Yemen Vibe","url":"https://yemenvibe.com/news-article/%D8%B5%D9%86%D8%B9%D8%A7%D8%A1-%D8%AE%D8%B1%D8%A8%D8%A7%D9%86-%D9%85%D9%88%D8%A7%D8%B7%D9%86-%D9%85%D8%AE%D8%A8%D8%B1%D9%8A-%D8%A7%D9%84%D9%85%D8%B3%D8%AA%D8%B4%D9%81%D9%89-%D8%A7%D9%84%D8%B9%D8%B3%D9%83%D8%B1%D9%8A.html","theme":"record_wrong","status":"alleged","id":"YEM-S002","pageUrl":"https://healthrecordrights.com/real-cases/#YEM-S002","countryUrl":"https://healthrecordrights.com/brief/yemen/","why":"A wrong result in the record nearly led to harmful treatment; patients rely on lab results being accurate.","sourceType":"journalism","lang":"ar","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ZMB","country":"Zambia","date":"2024-12-10","headline":"Court finds a hospital form was corrected improperly but rules the error harmless","paraphrase":"In a negligence case, the High Court found a nurse had shaded over an original entry on a patient's form instead of striking it out. It accepted this was human error and dismissed the claims.","source":"High Court for Zambia (Judiciary of Zambia)","url":"https://judiciaryzambia.com/wp-content/uploads/2026/02/2021Hp0790-James-Phillip-Mdala-Vs-Viva-Med-Limited-and-Others-%E2%80%93-2024-C.-Zulu-J-1.pdf","theme":"record_wrong","status":"finding","id":"ZMB-S001","pageUrl":"https://healthrecordrights.com/real-cases/#ZMB-S001","countryUrl":"https://healthrecordrights.com/brief/zambia/","why":"Corrections that hide the original entry make it hard to trust what a record said.","sourceType":"court_judgment","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ZMB","country":"Zambia","date":"2026-05-05","headline":"Health ministry staff shared passwords to the national patient record system","paraphrase":"Auditors found clinic staff with full system rights and 528 shared administrator accounts in the national electronic patient record. The ministry told Parliament that staff going on leave handed their passwords to colleagues.","source":"National Assembly of Zambia, Public Accounts Committee (report on the Auditor General's 2024 accounts)","url":"https://www.parliament.gov.zm/sites/default/files/documents/committee_reports/Report%20of%20the%20Public%20Accounts%20Committee%20on%20the%20Report%20of%20the%20Auditor%20General%20on%20the%20Accounts%20of%20the%20Republic%20for%20the%20Financial%20Year%20Ended%2031st%20December%2C%202024.pdf","theme":"other","status":"admitted","id":"ZMB-S002","pageUrl":"https://healthrecordrights.com/real-cases/#ZMB-S002","countryUrl":"https://healthrecordrights.com/brief/zambia/","why":"Shared logins mean no one can tell who opened or changed a patient's record.","sourceType":"parliament_testimony","lang":"en","providerName":"Ministry of Health (Zambia)","lastVerified":"2026-10-07","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ZMB","country":"Zambia","date":"2025-07-03","headline":"Insurance claims rejected because members' records listed the wrong sex","paraphrase":"Evidence summarised by a parliamentary committee said the national health insurer's own database still held inaccurate patient records, so some hospital claims were rejected because patients' sex was wrongly recorded as male.","source":"National Assembly of Zambia, Committee on Health, Community Development and Social Services","url":"https://www.parliament.gov.zm/sites/default/files/documents/committee_reports/REPORT%20OF%20THE%20COMMITTEE%20ON%20HEALTH%2C%20COMMUNITY%20DEVELOPMENTY%20AND%20SOCIAL%20SERVICES%20ON%20THE%20OPERATIONS%20OF%20THE%20NATIONAL%20HEALTH%20INSURANCE%20MANAGEMENT%20AUTHORITY%20FOR%20THE%20FOURTH%20SESSION%20OF%20THE%20THIRTEENTH%20NATIONAL%20ASSEMBLY.pdf","theme":"record_wrong","status":"alleged","id":"ZMB-S003","pageUrl":"https://healthrecordrights.com/real-cases/#ZMB-S003","countryUrl":"https://healthrecordrights.com/brief/zambia/","why":"A wrong entry in an insurer's records can leave a patient's care unpaid.","sourceType":"parliament_testimony","lang":"en","lastVerified":"2026-10-07","addedOn":"2026-10-02","inLanguage":"en"},{"iso3":"ZWE","country":"Zimbabwe","date":"2025-06-29","headline":"Fire at a public hospital destroys nearly two decades of patient records","paraphrase":"A fire in a storage building at a large public hospital destroyed patient records going back almost twenty years, according to a news report published after the health minister toured the damage.","source":"Pindula News","url":"https://news.pindula.co.zw/2025/06/29/sally-mugabe-hospital-fire-damages-solar-power-system-destroys-20-years-of-records/","theme":"other","status":"alleged","id":"ZWE-S001","pageUrl":"https://healthrecordrights.com/real-cases/#ZWE-S001","countryUrl":"https://healthrecordrights.com/brief/zimbabwe/","why":"Paper records kept in one storeroom can vanish in a single fire, leaving patients with no copy of their history.","sourceType":"journalism","lang":"en","lastVerified":"2026-10-01","addedOn":"2026-10-02","inLanguage":"en"}]}}