Westbury House: Piles of patient data finally cleared from care home

Piles of patient data were left unsecured in an abandoned care home more than four years after it was shut down and 18 months since the owner promised they would be removed.

Documents, including care plans, bank details and photos of injuries, were moved from Westbury House in Hampshire on Saturday after a BBC investigation.

Relatives of one ex-resident said the removal should have happened sooner.

Building owner Dr Usha Naqvi said she had been the victim of trespassers.

Dr Naqvi ran the home in West Meon until 2016 when it was shut down by the Care Quality Commission (CQC) for providing inadequate care.

The property has since fallen into disrepair and Dr Naqvi has been in the process of trying to get planning permission to convert it into 12 flats.

In the meantime, so-called urban explorers posted videos online from inside the 300-year-old building, which has suffered severe structural damage at the hands of vandals. Some of the clips showed people leafing through the files.

Dr Naqvi promised to hire a company to clear the documents after the BBC highlighted in April 2019 that, as well as confidential patient information, staff records and personal details of residents' relatives had been left behind in the building.

However, the family of one former resident had found the property remained accessible and many files were still there.

Lisa Ray-Saunders visited the home with her daughter where they discovered a file containing the personal records of her mum, who died at Westbury House in 2014 at the age of 49 after developing early-onset Parkinson's.

"It was open on the desk and people had clearly been looking through it," said Ms Ray-Saunders, who described "crying for days" after seeing the file included close-up photographs of her mother's bedsores.

"I just can't believe that Westbury would leave people's information in there - just because she's gone doesn't mean nobody cares.

"We all still love her and we don't want her information, her photos and all her private details out there."

Dr Naqvi attended the site on Saturday with her son Irvine Navid, the former registered manager of Westbury House, to oversee the files being cleared by a property maintenance company.

However, Ms Ray-Saunders said the action had come four years too late and she was "frustrated and angry" the situation had been "allowed to get this far".

Ibrahim Hasan, a solicitor specialising in data law, said the sort of sensitive documents left at the home could have been used for fraud and caused "serious harm" if they had fallen into the wrong hands.

He said breaches of data protection law should be enforced by the Information Commissioner's Office (ICO), which had powers to impose fines of up to about £18m.

"The requirements of the controller of the information is to keep it safe and secure and only to keep it for as long as is necessary," he added.

The ICO initially said it had taken no action as the home was no longer registered as a business.

However, after being passed the findings of the BBC's investigation, the ICO issued an updated statement, which said: "In light of new information received, we are reviewing the details and collaboratively working with partner agencies to achieve a positive conclusion to this ongoing situation."

Dr Naqvi said all the files had been taken away on Saturday but would not confirm whether they had been securely stored or destroyed.

In a written response to questions posed by the BBC before the files were cleared, Dr Naqvi said Hampshire County Council and the CQC were responsible for the files, a claim denied by both organisations.

She said the files had been under lock and key in the basement.

Dr Naqvi also said she had paid a firm to secure Westbury House, and was a victim of people trespassing on her property.