Email, text, phone, delivery, and messaging risks

Many pharmacy data breaches result from communication errors. The ICO specifically recognises accidental breaches such as sending an email to the wrong person. Comparable risks arise with text messages, phone calls, delivery handovers, and use of unapproved messaging apps.

Practical communication risks

• Email: wrong recipient, wrong attachment, visible recipient lists, and over-sharing of clinical detail.
• Text messages: old phone numbers, shared phones, and messages that reveal too much about a person's medicines or condition.
• Phone calls: giving information before checking who is speaking, leaving detailed voicemail messages, or discussing sensitive matters where others can overhear.
• Messaging apps: private WhatsApp or personal phones may not be approved for handling patient information.
• Deliveries: handing medicines to the wrong person, discussing contents on the doorstep, or leaving bags contrary to policy.

AI assistants and prompt risks

Staff increasingly use AI tools to draft wording, summarise text, or ask what to do next. Pasting identifiable patient information into a public or unapproved generative AI tool can be a serious confidentiality and data-protection problem.

ICO guidance makes clear that personal information included in user prompts remains personal data. If a staff member pastes a patient’s name, date of birth, NHS number, medicine history, symptoms, or service details into an AI chatbot, that information is still being processed and requires lawful handling and appropriate safeguards.

• Never paste identifiable patient information into a public or unapproved AI tool: even if the aim is only to improve wording or save time.
• Do not assume the tool is harmless because it is widely used: popularity does not make it approved or compliant.
• If your organisation has an approved AI tool and policy: use it only within that policy, with the minimum necessary information and appropriate safeguards.
• If a query can be properly anonymised: remove names, dates of birth, contact details, NHS numbers, addresses, and any details that could indirectly identify the person.
• If it cannot be safely anonymised: ask a pharmacist, manager, or governance lead instead of using AI.

Safer communication habits

• Verify contact details and identity: do not rely on memory or assumptions.
• Use the minimum necessary wording: especially in text messages and voicemail.
• Use approved systems: if the pharmacy has a secure platform, use it instead of personal apps.
• Think before sending: names, attachments, and auto-fill errors are common causes of breaches.
• Follow the delivery SOP: when in doubt, return the item or escalate rather than risking a wrong handover.

Delivery teams and support staff