What happened?
In October 2024, it was discovered that employees of City of Helsinki dental care had accessed clients’ personal and medical data without authorisation. The investigation identified five employees involved in these breaches, affecting a few thousand clients.
Why was the data accessed without authorisation?
The exact reason is unknown. However, the likely causes include curiosity and carelessness.
What were the consequences for the affected clients?
As far as we know, these incidents did not cause harm to clients. The data was not shared with anyone, for example. However, we are legally required to notify the affected clients. We regret that this happened.
What type of data was accessed, and whose data was involved?
The employees accessed clients’ personal data without authorisation, including names, addresses and personal identity codes. They also accessed information related to clients’ treatment and appointments without authorisation.
Some employees also accessed the medical records of their family members, colleagues, loved ones and public figures without authorisation.
To what extent can dental care professionals access patient data?
Dental care employees have extensive access to patient data to ensure safe and effective care.
What actions have been taken in response?
Due to the scale of these breaches, investigating them has taken time. We have conducted a thorough review of our client and patient data records to identify all instances of unauthorised access.
Are the employees responsible still working for City of Helsinki dental care?
No, these employees are no longer employed by City of Helsinki dental care.
Have there been delays in the investigation? Can clients trust the service?
There have been no delays in investigating these breaches. We began the investigation as soon as the violations were detected and have communicated openly and without delay. Affected clients will be notified of the findings by letter.
We want Helsinki residents to trust that dental care client data is handled responsibly and confidentially. Any data breaches are thoroughly investigated, and affected individuals are informed without delay.
Who is responsible for the breaches?
The breaches were committed by dental care professionals who accessed data without authorisation. Clients bear no responsibility for these incidents. The breaches were not caused by any carelessness on the clients’ part.
How have clients reacted?
Some clients have expressed concern about the breaches. We understand that this situation may cause distress.
Have the incidents been reported to the police?
Yes. The Social Services, Health Care and Rescue Services Division has requested a police investigation, as the breaches involved extensive unauthorised access to patient data.
How will you prevent similar incidents in the future?
Following these incidents, City of Helsinki dental care is reviewing its guidelines on processing client data and strengthening self-supervision. Staff information security training has been increased, and supervisors will ensure that all new employees are properly trained in data protection and the use of client information systems.
Staff competence assurance practices will be documented in the self-supervision plan for health and social services. This process has been described in the self-supervision plan for health and social services guidelines (sosiaali- ja terveyspalvelujen omavalvontasuunnitelman ohje) starting from page 7. The guidelines are available on the City of Helsinki website (in Finnish).
Where can affected clients find support and further information?
The Office of the Data Protection Ombudsman provides guidance for individuals affected by personal data breaches(Link leads to external service) .
Additionally, support is available from:
- Crisis Emergency Support in Helsinki (available 24/7), tel. +358 9 310 44222(Link starts a phone call)
- Victim Support Finland, weekdays at 9.00–15.00, tel. +358 116 006(Link starts a phone call) , or via RIKUchat at riku.fi/chat(Link leads to external service) (weekdays at 9.00–15.00)
Helsinki residents may also request access to their personal and patient data to see who has accessed their records. More information is available here: Requesting client data