HSE accuses medical supplies company of holding it to ransom over patient data

High Court Reporters

A medical supplies company has been accused in the High Court of an “outrageous attempt” to hold the HSE to ransom by allegedly demanding over €140,000 from the executive to “maintain the integrity” of sensitive patient data in its possession and threatening to sell the data.

Mr Justice Brian Cregan on Thursday granted an interim injunction restraining PMD Device Solutions Ltd from selling, transferring or providing access to the patient data to any third party outside of the HSE, whether as part of a sale of assets or under any other arrangement.

He also directed that the business preserve and maintain the data until further court orders.

According to court filings, PMD Device Solutions Ltd, a subsidiary of Swedish company PMD Device Solutions AB, held several contracts with the HSE to provide respiratory monitoring services – including providing respiratory rate sensors for use in hospitals across the State, and cloud storage of patient data.

PMD terminated those contracts with the HSE in December 2024, after, according to a media report cited in court, the firm’s parent company filed for bankruptcy in Sweden.

Mr Justice Cregan made the orders after the HSE applied for the injunction, claiming that PMD Device Solutions has sought payment from the executive to ensure the integrity of the patient data it holds, “in circumstances where the [company] is under a duty to keep the data secure, and to return or delete it upon the termination of certain contracts”.

As the application was made ex parte, PMD Device Solutions was not represented in court, and has not yet had an opportunity to respond to the claims made in court.

The HSE claims that when it engaged with PMD Device Solutions to facilitate the transfer of patient data following the termination of contracts, the company said that, to “ensure the integrity” of the data, it was seeking a payment of €145,000, excluding VAT, from the executive.

The HSE says that PMD Device Solutions “has no contractual entitlement to payment in return for compliance with its obligations to return or delete the [HSE’s] data, and to maintain its integrity”.

The HSE says that PMD Device Solutions chief executive Myles Murray wrote in a January 13th email to the executive that third parties “will be able to begin bidding and purchasing” on the company’s assets “within 12 days”, after which the company “will have no ability to stand over the integrity of the data”.

Mr Murray added that this issue was raised with the HSE “on several occasions before the new year and that the current time pressure is related to the bankruptcy process”, according to the court filings.

The HSE says that Mr Murray emailed on January 22nd, stating: “We are now preparing to sell the company’s assets.”

This correspondence “demonstrates an outrageous attempt to hold the HSE to ransom over the integrity of the person data”, the HSE says.

Claire Hogan BL, appearing for the HSE and instructed by Beauchamp’s Pat McInerney, said that the company’s alleged “threatening” to compromise the integrity of the data amounted to “essentially a form of extortion”.

Mr Justice Cregan adjourned the matter to Monday. Asked by the judge if it was possible PMD Device Solutions could go into liquidation before next week, Ms Hogan said there was a risk, but that they are “not aware of the exact activity that the defendant is making in this regard”.

In a separate action, PMD Device Solutions has sued the HSE, claiming it is owed over €1.2 million by the executive for its services.

The HSE is contesting the action.