Doctor triggers patient data breach after confidential phone call is overheard

A doctor who discussed confidential medical information on the phone while examining another patient has triggered a data breach investigation after sensitive details were overheard by people in the room.

The incident happened in Guernsey and was highlighted in the latest figures published by the island’s Office of the Data Protection Authority (ODPA), which regulates the use of personal information.

The doctor answered a telephone call while examining a patient and remained in the room throughout the conversation. During the call, identifying information and sensitive details about a different patient’s health were discussed loudly enough to be heard by the patient being examined and other people nearby. The healthcare provider employing the doctor subsequently reported the incident to the data protection regulator.

The ODPA concluded that information had been disclosed to people who had no legitimate reason to receive it and were not involved in the care of the patient being discussed. Because medical information is particularly sensitive personal data, the incident created a risk of distress and loss of privacy for the person concerned.

The case provides a reminder that healthcare data breaches are not limited to electronic records, cyber attacks or documents being sent to the wrong person. Confidential information discussed verbally can also be improperly disclosed if conversations take place where patients, visitors or other unauthorised people can hear them.

Following the incident, the healthcare provider reminded the doctor of their data protection responsibilities and arranged for the lessons from the case to be discussed urgently during an academic session involving its doctors. The regulator recommended that confidentiality and data protection training should also be provided to new members of staff and refreshed annually.

The incident was included in Guernsey’s data breach figures for the second quarter of 2026. The ODPA received 49 breach reports between April and June, with four classified as high risk. Ten other reports were subsequently found not to meet the threshold for a reportable breach. The most common type of incident continued to involve emails being sent to the wrong recipient, while loss of confidentiality remained the most frequently identified potential harm.

Data Protection Commissioner Brent Homan said the case demonstrated that protecting personal information was not simply about securing records and computer systems, but also about being conscious of conversations that could be overheard.

The issue is particularly important in healthcare, where staff routinely need to communicate sensitive information while working in busy environments and moving between patients. For doctors and other healthcare professionals, the case is a relatively simple reminder with potentially significant consequences: confidential information needs to remain confidential regardless of whether it is contained in a medical record, displayed on a screen or spoken during a telephone conversation.

Stay informed with the stories shaping health and social care.