Active discussions

Please or to access all these features

Talk
AIBU?

Share your dilemmas and get honest opinions from other Mumsnetters.

Original poster

Is this normal? Nhs employees

58 replies

Chiefspidercatcher · 15/10/2024 19:35

I don't think it is. Or it shouldn't be.

I work in a GP practice. Not long started.

I've witnessed a newbie given a 'spare' smart card (which belonged to a colleague on leave, a spare for them sonehow the practice manager has) to access eg emis while training before newbies own smart card arrived.
So colleague was on leave but there's logged actions throughout the system that they eg ordered prescriptions, blood tests etc as their smart card was used.

I had a patient complain earlier this week about a request not done from a week prior. I checked the system & was shocked to see my own name logged as the person cancelling their request. I didn't remember doing this & am v careful. When I got home later I checked my shifts & I wasn't in work when it was done so someone must have a spare smart card for me & be accessing the system using my profile.

I feel like the risks & ramifications are huge.

Am I overreacting? Does this go on?

I'm trying to decide how to proceed. I'm concerned about patient security & confidentiality being compromised. Also the risk of reputational damage to me or anyone else whose card is being used by someone else for goodness knows what.

I think the PM is likely the one who has the spares & letting certain ppl access them. However we are a small practice & she'd also be my point of contact to raise issues to so I'm not sure which way to move forward. ICO suggested whistleblowing. Has anyone else been in a similar position?

OP posts:
nocoolnamesleft · 15/10/2024 20:35

This sounds extremely dodgy. I'd be majorly freaked out.

Original poster
Chiefspidercatcher · 15/10/2024 20:32

babsnet · 15/10/2024 20:26

This is not right. Check if you have a named ‘Freedom to Speak Up’ guardian. If you have one speaking to them would be a good place to start

Every contact for everything is the PM. Where do you go when they are the problem.

Found this
https://digital.nhs.uk/services/care-identity-service/smartcard-and-authentication-users/change-your-smartcard-passcode#:~:text=To%20change%20your%20passcode%2C%20put,boxes%20and%20select%20'Confirm'.
to change passcode so will do that nxt time I'm in & hope it covers all access.

Change your smartcard passcode - NHS England Digital

How to change your smartcard passcode in Care Identity Management.

https://digital.nhs.uk/services/care-identity-service/smartcard-and-authentication-users/change-your-smartcard-passcode#:~:text=To%20change%20your%20passcode%2C%20put,boxes%20and%20select%20'Confirm'.

OP posts:
Original poster
Chiefspidercatcher · 15/10/2024 20:28

PullTheBricksDown · 15/10/2024 20:25

I would assume that the pass code has to match the login id being used for that card at that time? I would change anything you can and not to anything others could guess. I'd hope that would render the other card useless.

Also, I know you said it takes 14 weeks to get an investigation going but if that means it wouldn't start till after you'd gone, that might actually be helpful. I would be looking for a new job you could start ASAP in any case.

Show quote history

It's a great idea & I already have a new job offer! Just waiting for due diligence to complete before I can hand my notice in.

OP posts:
babsnet · 15/10/2024 20:26

This is not right. Check if you have a named ‘Freedom to Speak Up’ guardian. If you have one speaking to them would be a good place to start

PullTheBricksDown · 15/10/2024 20:25

Chiefspidercatcher · 15/10/2024 19:53

Does anyone know if its possible to change your 6 digit login?

Mine is known to everyone. It was announced in the office & is v memorable. Altho it depends if I changed my passcode on the card I have would it change for both cards or just the one I was using at the time.

I would assume that the pass code has to match the login id being used for that card at that time? I would change anything you can and not to anything others could guess. I'd hope that would render the other card useless.

Also, I know you said it takes 14 weeks to get an investigation going but if that means it wouldn't start till after you'd gone, that might actually be helpful. I would be looking for a new job you could start ASAP in any case.

Original poster
Chiefspidercatcher · 15/10/2024 20:25

Sailawaygirl · 15/10/2024 20:20

I'm very surprised that 2 smart cards can be active at the same time for same person!
Yes this is complete no no. I've once had to add notes for a colleague as she was called out of work on an emergency but managing to email them to me to add to record, but I very clearly explained in the electronic notes that I did not see the pt but was just adding the notes.

I'm really surprised too. But I can assure you it must be possible because I've seen the newbie using the persons on leave, and saw the persons name who was on leave all over the system (tasks, bloods, prescription req). And my own name against an action I didn't do at a time I wasn't working.

I'd be in major difficulty if someone used it to do something bad when I was in work. I'm not sure it'd be possible to fully prove it wasn't me in that scenario.

OP posts:
Sailawaygirl · 15/10/2024 20:20

I'm very surprised that 2 smart cards can be active at the same time for same person!
Yes this is complete no no. I've once had to add notes for a colleague as she was called out of work on an emergency but managing to email them to me to add to record, but I very clearly explained in the electronic notes that I did not see the pt but was just adding the notes.

TeaMistress · 15/10/2024 20:20

It's absolutely not normal. Huge breach of information governance.

Original poster
Chiefspidercatcher · 15/10/2024 20:20

We don't have an IT dept, everything goes thru the PM who has separate office at other end of the building. Everything I do is done in the communal reception office where patients also pass & at least 1 other receptionist most of the time is near so no calls are private. I'd not put it past the PM to call IT & req my new passcode if I changed it either given how they've behaved so far.

OP posts:
kab89 · 15/10/2024 20:14

Absolutely not normal at all. I would suggest phoning your IT department and ask them to change your log in pin. They should be able to do this for you or talk you through how to do it yourself.

I also agree with pp's that this need to be reported.

Original poster
Chiefspidercatcher · 15/10/2024 20:07

I'm glad my instinct was right & I'm not overreacting at least.

OP posts:
CarpetSlipper · 15/10/2024 20:03

No this is not normal at all. Only you should know your pin and login details should not be shared.

ByQuaintAzureWasp · 15/10/2024 19:59

This is gross misconduct.

You need to put in a greivance regarding your case. If you'd been on duty yiy'd be stuffed.

ParadiseInKefi · 15/10/2024 19:59

This reply has been withdrawn

This message has been withdrawn at the poster's request

Original poster
Chiefspidercatcher · 15/10/2024 19:59

themonkeysnuts · 15/10/2024 19:56

surely its a GDPR breach. using others access codes is so wrong on every level especially NHS

Yes this is why I contacted ico to query, they suggested whistleblowing but said it's up to a 14 wk wait for anything to be done. I plan to be gone by then.

OP posts:
Rudicoolcat · 15/10/2024 19:58

bergamotorange · 15/10/2024 19:39

That's really bad.

I agree use the whistleblowing policy, or speak in confidence to a senior partner.

This, this, this! And do it tomorrow. You are vigilant and professional, and we appreciate people like you in the GP surgery 👏🏼

StormingNorman · 15/10/2024 19:57

I wouldn’t discuss anyone else’s actions but ask about your own situation.

Say you were looking into a customer call and your name was logged against an action but you weren’t on shift at the time. Just tell her you want to flag that there might be a problem with the system.

See where that goes.

themonkeysnuts · 15/10/2024 19:56

surely its a GDPR breach. using others access codes is so wrong on every level especially NHS

GlitchStitch · 15/10/2024 19:53

We have spare smart cards for bank staff, new starters etc but they have to be signed in and out. Absolutely not allowed to share log ins.

Original poster
Chiefspidercatcher · 15/10/2024 19:53

Does anyone know if its possible to change your 6 digit login?

Mine is known to everyone. It was announced in the office & is v memorable. Altho it depends if I changed my passcode on the card I have would it change for both cards or just the one I was using at the time.

OP posts:
Original poster
Chiefspidercatcher · 15/10/2024 19:51

I'm amazed 2 smart cards stay active. Surely only one should be activated at a time.

OP posts:
Original poster
Chiefspidercatcher · 15/10/2024 19:50

NewmummyJ · 15/10/2024 19:42

Yes I've known it happen even though it's a big no for the reasons you've described. Often these practices are normalised as ok when they're clearly not. If the PM is instigating it then you're in a tricky place.. in my experience whistle blowing never ends well in the NHS (for the person who raises concerns), it's such a toxic culture.

ICO said I could request to stay anonymous. We have nhs patients but the practice is privately owned. Not sure if that makes a difference.

I'm planning on leaving before Christmas. It's a terrible environment to be in, it's really getting to me for a host of reasons but the others are more personal. This feels a responsibility to the public to not ignore & for my reputation if someone is accessing the system under my name. It's purely chance I discovered this action & checked the history of the error so I'm worried what else lurks that will appear to be my work but isn't.

OP posts:
Doyouthinktheyknow · 15/10/2024 19:45

Not normal at all, really concerning!

We aren’t meant to share logins at all or give anyone else access but the trust make no provision for medical students so there are times I support them to gain access to notes using my login but only when I have logged in and under supervision!

Original poster
Chiefspidercatcher · 15/10/2024 19:44

PinkiOcelot · 15/10/2024 19:41

No it’s not normal. Why would anyone need a spare smart card for you or anyone else?!

I think the PM reordered cards when originals didn't arrive quick enough & they thought the original card was lost in transit. Then when the 2nd turned up the PM kept both. I've heard them say they have 2 for themself aswell. I stuck me as less secure to have spares in a cupvlboard somewhere but I'd just started & was processing a lot of info.

OP posts:
ahemfem · 15/10/2024 19:43

I don't work in the NHS but in my industry it's absolutely NO shared log ons.