972,640 Euro fine against Capio St. Göran Hospital AB
Missing requirement and risk analysis for access to patient data and too extensive authorisations.

The regulatory authority audited eight clinical facilities for adequate risk management and effective access restrictions to their core systems. The responsible administrations of seven of the audited facilities were fined for deficiencies.

One of the facilities found at fault was Capio St. Göran Hospital, where it was found that no risk analysis had been carried out for access to patient data. Authorisations for users of the hospital information systems Cosmic, Nationell patientöversikt (National Patient Overview) and TakeCare were not assigned according to the principle of data minimisation. This gave users wide-ranging access to confidential data of patients who did not need this data at all for their activities.