Is this normal? Nhs employees

Log it as a whistleblower - at least there will be a paper trail. Also if in England the Cqc could be advised.

Reading back through this is absolutely and utterly wrong on so many levels.

No one should ever be able to use your smart card or know your login pin.

Please, please whistle blow. For the patients sake.

As a HCP in a GP practice this is an absolute and utter no go. If needs escalating. If they're doing that, god knows what else is going on!

Every practice is obliged to have a data protection officer. That person is usually supplies by your local ICB.

If you contact your ICB's data protection team they will be able to locate the relevant person for you. You can often do this through an FOI email address if you can't find anyone else as they tend to sit in adjacent teams if not the same team.

This passcode practice also needs reporting.

It's scary how lax the behaviour is.

That is awful. When I have worked with smart cards the first swipe of the day still needs a name and a password used. It has then worked as fast access into the system multiple times that day (sometimes requiring a password input if you have been away for too long. )
The same smart card could absolutely be used by someone else a different day. But they would need to enter a user name and password at the start again.
You should 100% never be in a situation that someone can log in as you though. That risks massive privacy breaches that would land in your lap.
Good luck figuring it out.

You really need to get that passcode changed a when mine was set up I was asked to put a code in whilst the person setting it up looked the other way so no body knows my passcode or has any reason to.

I'm an nhs podiatrist and I can tell you that this is ABSOLUTELY not allowed and needs to be reported.

This is massive. You do need to report to protect yourself, and need to report as duty of care within your role. You need to be defensive in how you do this.

In an NHS Trust you would definitely use freedom to speak up guardian for whistleblowing.

You could email (so in writing) the PM copying in senior partners and your union rep. This would mean you have followed correct procedure but also means it cannot be covered up by the PM. Include precise dates and times as your evidence (screenshots may not be possible) as this is how an HR investigation would be conducted. Be utterly factual, do not include supposition or hearsay, but just state the known facts about your own case (evidence things were entered under your name whilst your were away, precise dates and times, you can name the patient this happened for - they will search the system for this evidence after).

This is against all NHS GDPR, information governance and data security policies. You need to report it. I would also suggest you ask for the spare smart card that is in your name so that it can’t be used again. If there’s a patient incident and your names if flagged then unless you can prove you weren’t on shift then you could find yourself in a sticky situation (although I’m unsure how they are using it without your password/PIN number).

@Chiefspidercatcher what @godmum56 said

@Chiefspidercatcher using someone else’s credentials to login is fraudulent. In most places it would be a sackable offence/gross misconduct.

Perhaps the way to handle it is to ask ‘how come these transactions are recorded against my ID when I wasn’t in the office, wasn’t working and had my card in my possession?’

This is awful and would be gross misconduct where i work.

And that’s without even considering WHY someone has used YOUR login to anonymously cancel a request against a patient’s wishes?! Something very suspect there. Could anyone know you’re leaving and have it in for you??

There may be a IT service desk that covers the local area. In the trust I work for, the contact details are on everyone's desktop background.

It's definitely wrong and needs flagging above the practice manager.

Are you able to get evidence that this is happening?

Definitely, 100% not ok. Given accessing patient data without cause is a criminal offence and there are records of who’s viewed what it also opens whoever’s card it is up to risk if someone uses their card to look at something they aren’t supposed to.

That's awful!!! That's a huge breach - definitely whistleblowing territory I'm afraid.

Phone IT yourself there isn't one in the practice but all IT is run through the health board (or equivalent where you are) . In Scotland our system didn't have smart cards but all individual log ins. We were not allowed to share. Sometimes locums spent ages in the phone to IT if their logins failed to work. IT would not tell PM your code.
Tell senior partner. I used to have this role and my door was always open to staff with concerns.

That’s what I was thinking.

At least then you could keep it with you at all times and know you were “safe” until you leave.

EX NHS manager here who used to work with GP's a lot. Not normal or right but did you know that GP's are not NHS employees? So far as I am aware, all practices are privately owned. GP's are contractors. The person you'd normally go to about this would be the practice manager but it sounds like that won't help. The only thing I can suggest is that you try and contact someone in data management from one of the hospitals used by your patients. The person who is at the top of the responsibility tree is called the Caldecott Guardian and a letter or email to them or their office should set a bomb off. Google How to to contact a Caldecott Guardian for more info.

I think actually this is commonplace although it’s absolutely against policy and you can very much whistleblow about it and you should be taken seriously. A friend has been disciplined for something similar (not GPs) although she is adamant it’s commonplace in order to be more efficient.

Personally I’d ask her about the prescription cancellation, say you didn’t cancel it (you weren’t working) and yet it shows as cancelled by yourself? There must be a second card in use by someone else and so you'd like to take it so that you have both your cards in your possession.

Can you “lose” your card so the PM has to give you your spare?

Sorry cross posted. I'm pleased you have found how to change your pin.

There should be an IT department for the CCG who deal with this, not an IT department at the surgery. Could you phone the emis helpline number which is on your desktop homescreen and see if they can help put you in touch with IT. If it was me I wouldn't care if the other receptionist knew that I have done this.

I know you are leaving soon but as everything is auditable there will be entries etc under your log in. I haven't used emis for a few years but I think there may be an icon on your desktop for changing your smartcard log in pin, I could be thinking of something else though.