To report ex friend who looked at my medical files?

If people were making up stories about me and using my medical information I'd want them sacked amongst other things.....

I would absolutely report. I work in the nhs and this behaviour is not okay!

This.

It is not the data breach that has motivated you, it’s a spiteful act of revenge for reasons that are entirely divorced from the data breach.

Maybe she does, or maybe its just what she said and I can see her point, Id feel really uncomfortable in this situation too.

Would I be unreasonable to make sure she is blocked from viewing my files again, there’s no need for her to access them as the issue to do with her department is long past & while I brushed it off before when I thought she was was a friend her having access now makes me very uncomfortable.

Putting your situation aside, this is a gross breach of conduct. She could be looking up anyone. Report it.

If she accessed your information without a valid reason then she was 100% in the wrong and she will have had training that means she can't possibly not have known this.

If you report her, her employers should investigate and can see when/ what she accessed and investigate to see if she had a valid reason to do so. If she's found to have breached acceptable use/ access she will face disciplinary action, may well lose her job or professional registration and find it difficult to find employment in a similar field again.

Reporting her at the time because she abused her position would have been justifiable... maliciously reporting her now because you've since fallen out, and potentially wrecking her life as a result... I wouldn't want to be friends with with someone who'd do that and I'd think you were both as bad as each other.

@TimeGoesBySoSlowlyForThoseWhoWait this was 10 years ago now and she's since passed away.

Apologies if I’ve missed it, but I can’t see where it says that OP wants to report the breach, just that she wants to ensure the person can’t access her files anymore.

Looking up your notes without permission was way out of order. But you should have complained there and then.

When DH was at the start of his career, someone working at the hospital looked up his notes, and reported a health issue to prospective employers (one of them married to the one who looked notes up). It had rather unpleasant consequences and I always regret that we didn't make an official complaint.

This. Everyone's acting like you're out for revenge but actually she shouldn't have done it in the first place and no one would want someone having access to that information if that person is being malicious.
I'm in a role with access to plenty of people's private information. It is made very very clear that we can't be accessing records for our own interest so she can't claim she doesn't know that.
Please do report her. Any consequences are hers to face for breaking the rules and not on you.

If you'd of done it at the time it wouid of been for the right reasons at this point 👉 you are just looking for revenge but no remember this person will had a huge amount of animosity towards you if sacked.

I don't agree, if this person has done nothing wrong, then she has nothing to worry about, if she has, how many more times has she done this? Through misguided loyalty she wasn't reported in the first place and now the OP has clarity and should report.

Yes absolutely report.
This happens to my friend who is a nurse, someone she worked with had accessed both her and her kids records.
It turned out she had been doing it to numerous people she was friendly with/worked with despite being aware she wasn't allowed it and having no reason to look at any of their kids records.
A lot of people were then contacted by the hospital and there were serious repercussions for this woman, understandably.

Yes report it. She'll get sacked so it won't be an issue anymore

Hi OP, anyone employed in a public service capacity (with professional registration or otherwise) is legally bound to access data that is relevant to their role and not for personal interest /enquiries. So this includes admin and reception staff also. All staff in such roles are legally bound to GDPR regulations and any breach of that is extremely serious. If you report this lady, it is highly likely that she will lose her job.

Years ago when I worked in insurance someone pulled up Tony Blair’s credit file and was fired for gross misconduct.

its unethical behaviour

I’d be reporting to every professional body she was a part of. And people wonder why there’s very little respect for the medical profession these days.

I’d probably report her. My friend asked me to check when her smear was due as she couldn’t remember and I declined as I couldn’t justify why I’d looked if it was audited. I would happily check if I was planning to take the smear, but I won’t look at records based on a query.

What happens when she does it to another friend or person? Its a basic principle of working in the NHS that you don’t access someone’s medical file unless you absolutely need to. I don’t think she should be allowed to get away with it, even though OP should have reported her at the time.

If she's snooping at your records she's most likely snooping at others. She knows the rules as anyone with access to that kind of data. There is an audit trail as others have pointed out but it isn't actively being watched across every client all the time. It's looked at after the fact unless there is a flag or restriction on that record. In some settings records can be restricted so that only certain users can access it without seeking authorisation. Don't want to lose your job? Don't do shit like this.

And she would have yearly training on it so there’s no excuse she didn’t know this aswell.

Absolutely report her - you can only access medical files when there is a medical need to (e.g. she was directly dealing with your appointment, treating your illness etc). It is a breach of confidentiality to just decide to look at your file to ‘find out what was going on’. Report to the Manager where she works.

YANBU

This would be a sackable offence. Its not as simple as asking for her to be blocked in the future, she would be investigated and likely sacked for looking at them previously. Information governance and data security is a hot thing in the NHS at the moment.

They can but only to the level necessary for the actual work they do. They are not meant to just go trawling through somome's notes and read everything on there. When I worked in mental health there were specific levels of access to patient records.

You would not have been unreasonable to report her when it happened a year ago. Or shortly after.

You would be very unreasonable to report her now - just because you have fallen out and she’s stabbed you in the back. This would purely be stabbing her in the back in return, an act of revenge. It will likely get her fired. Can you live with that? I couldn’t. Rise above it and be proud to be the better person.