Case: 202501525
NHS organisation: Borders NHS Board
Subject: Complaint handling
Outcome: Fully upheld
Date: March 2026
Summary
C complained to the INWO about the handling of a confidentiality breach. The breach took place during the Board’s whistleblowing investigation but C was not told at the time. C said that when they were informed, the Board did not provide enough information about what happened, nor offer sufficient assurance that the breach had been contained.
We found that the confidentiality breach was the result of human error and although reasonable action was taken to understand and contain the breach at the time of the disclosure, neither C nor the relevant staff within the Board were informed about it.
We found that once C had been contacted about the possibility of a breach, it took too long for the Board to establish the facts of what happened and share the information with C. Despite repeated attempts by C to get more information from the Board they were unable to provide it. The communication with C was confusing.
We also found that the Board did not take immediate steps to involve their information governance team or seek advice on managing the breach.
We upheld C’s complaint.
Recommendations
What we asked the organisation to do in this case:
- Apologise to C for the issues identified in this report, including an acknowledgement of the impact of this experience. The apology should meet the standards set out in the SPSO guidelines on apology available at www.spso.org.uk/information-leaflets.
What we said should change to put things right in the future:
- The Board should ensure that everyone involved in handling and investigating whistleblowing concerns understand the Board’s data protection and information governance responsibilities in relation to confidentiality breaches. The Board should reflect on the findings of this report and consider ways to strengthen their processes to ensure that:
- information can be gathered quickly,
- communication is transparent, and
- staff are supported.