A hospital in Ubon Ratchathani province, northeastern Thailand, has been fined 980 million VND (40,000 USD) after over 1,000 pages of confidential patient records were found being used as wrappers for street food. The hospital's name has not been revealed.
The incident came to light in May 2024 after an online influencer posted images of the medical documents being used to wrap sticky rice, fried bananas, and other snacks. Patient information, including a diagnosis of hepatitis B, was clearly visible on the wrappers.
"Should I continue eating this, or is this enough?" the influencer quipped in their social media post, which garnered 33,000 reactions and 1,700 comments. The hospital faced widespread criticism as the post went viral.
 |
Medical records used as food wrappers by street vendors. Photo: SCMP |
Medical records used as food wrappers by street vendors. Photo: SCMP
On 1/8, Thailand's Personal Data Protection Committee (PDPC) announced it had fined the hospital for violating data protection laws. The PDPC's investigation revealed that the records were leaked during the document disposal process.
The hospital had contracted a family-run business to destroy the records but failed to supervise the process. Instead of destroying the documents, the contractor stored them at home and didn't inform the hospital about the leak. The records somehow ended up as street food wrappers.
The PDPC concluded that this violated the Personal Data Protection Act, which mandates doctors and organizations handling medical data to maintain patient confidentiality. The contractor was also fined 14 million VND (580 USD) for negligence.
Public reaction has been strong, with many criticizing the hospital and others expressing food safety concerns, given the unsanitary handling of the records and potential toxins in the printing ink. "Buyers should boycott shops that use recycled bags like this," one commenter said. "The sellers want to cut costs even though they know it's not safe. Medical documents should be destroyed, not sold."
Thailand's 2019 Personal Data Protection Act, effective from June 2022, aims to protect individual privacy while allowing businesses to collect necessary data for legitimate purposes. The PDPC can impose fines for various violations, including failing to appoint a data protection officer (up to 1 million baht), inadequate security measures, and failure to report data breaches (up to 3 million baht). Some violations can also result in imprisonment of up to one year and fines of up to 500,000 baht.
Hai Thu (SCMP)
