I’ve reported my friend for an NHS confidentiality breech

She should lose her job. You can't just go gawping at your mates' records! And even worse sharing the information! That breaks pretty much information governance rule the NHS has.

Your mutual friends need to think about the fact that she is clearly comfortable not only snooping in all of your medical files, but also sharing the information she finds with anyone who sits still long enough to hear her. They can have no expectation of privacy or confidentiality at all for as long as she retains that job.

She has broken company policy by looking at the records and she's broken the law by then divulging it, and it is a law, and it is her not the NHS that is culpable.

One of the changes that GDPR bought in was that the company (data controller) has ultimate responsibility to protect data, but also that under certain specific circumstances, an individual within a company or organisation can be fined for breaching data privacy law.

One of those is unlawfully obtaining personal data without permission from the data controller.

Given that every staff member in the NhS is repeatedly trained on not accessing records unless you have a valid reason to, and maintaining confidentiality of any records seen, there is a valid argument that she as an individual has broken GDPR and should be subject to action by ICO. It would be very rare for them to actually do it, but she really has fucked up.

Well done OP for reporting this person. What she did was very wrong and a total breach of trust.
Would your friends be so enraged at you if she had accessed their records and spread intimate and perhaps tragic information, The only person at fault here is Karen and she fully deserves to lose her job.

The obvious point is that Karen has proved to her managers that she is completely unsuitable for any job which requires confidentiality of sensitive information. She has to be sacked otherwise she will do it again.

Has she apologised to you?

I work for the NHS we do mandatory Information governance training every year. This is a massive breech of confidentiality.
The IT dept can see all the notes that she has accessed. She had no reason to access your notes.
This is most definitely a sackable offence.
I worked alongside someone who did this she was quite rightly sacked.

It's a very serious offence and it gets drummed into us not to use our NHS log ins to look up anyone's file we do not have permission or clinical need to view. I would have reported her too, she knows the rules and was very open about breaking them. If she loses her job that's on her, not you.

No. The consequences are on Karen, not you.
Tell your friends you are NOT OK with Karen accessing your personal health records and a friend doesn't do that. Then tell them to reconsider their values since they are defending it and block them all. FFS. Don't be gas-lighted. You were right to report her and are well rid of her. Do not feel bad. Be pissed off and disgusted.

Well done for reporting it, your ex friend 100% deserves to lose her job over this and you shouldn’t feel guilty at all.

I would have reported my friend too, that’s disgusting behaviour and I can’t believe people have fallen out with you over it. I’ve worked in education for many years and have often had people ask me questions about children, there is no way I’d ever tell anyone anything. You have nothing to feel guilty about OP.

Former Midwifery Assistant here. At my Trust, your colleague would be invited to attend a meeting at which her line manager and a HR advisor would be present. The allegation would then be placed to her, and she would be given a chance to explain/justify her actions. Assuming she couldn't, she would be informed of an impending investigation, and suspended with immediate effect whilst the investigation took place. The process would also be formally detailed in a written letter. Following its conclusion, she would be formally invited to a second meeting (with a Union Rep present, if requested), and made aware of the allegations, and given a further chance to explain her actions. If evidence from her IT history suggested there was a case of gross misconduct to answer, she would likely be dismissed with immediate effect.

The same happened to a former colleague of mine, who was found to have accessed maternity records of several friends and relatives.

Please don’t feel guilty. She has massively breached GDPR and this is unacceptable.

I work for the NHS (clerical), and it is drilled into us to not access patient records without needing to for work purposes. The system I use at my Trust, when we access a patient’s record/notes a pop-up box comes up and we need to type in a reason why we are accessing these. For example, “I am dealing with a complaint and need to access the records for a particular appointment” etc.

If she does this to a lot of her “friends” just for a nosey then it should, hopefully, already be flagged up on the system she is using. Her actions will leave a digital trail.

So please do not worry if she gets sacked. As it will be her fault. Not yours.

Best wishes for the rest of your pregnancy. You’re so much better off without friends like this woman 💐

My friend's MIL was sacked for accessing records she had no reason to access, including my friend's pregnancy records. They had suspected she was doing this, but had no proof until it was picked up during an audit. After being sacked the MIL was complaining that these were people who would have told her about their condition anyway... funnily enough this was not accepted by HR.

She'll lose her job if she did it

Your friends are idiots, Op.

She invaded your medical file and told people your medical information. She shouldn't be anywhere near patient information and she deserves to lose her job. She knows it isn't acceptable. Anyone that works with data like this does.

Congratulations on your pregnancy. Don't let this overshadow it!

She wsd wrong. It worth calling pals at the hospital. They can look in to the complaint and how it's being dealt with.

You were right to report her.

Anyone that backs her is just as bad.

She would have been made well aware in her job that she must not look up friends and family otherwise she boils lose her job so she is completely responsible for facing the consequences of her actions if she is sacked.

You're going to be busy with a baby so concentrate on that and not these nasty gossipy women.

She should be sacked. I worked in a bank. We had the same we could not look at family or neighbours accounts just because. We had to have a legitimate reason and it’s sackable offence

Its the same in the nhs unless you have an actual requirement you can’t look at records and even if you did have a requirement you can’t discuss that information with third parties and she has done both.

Do not feel sorry for her as an adult she knows any actions she takes have consequences and she chose to both look and tell people about your health record's

As to your friends. ask them how they would feel if they or a family member were diagnosed with Cancer/STD or whatever and someone told all their friends
If they can’t see that they are not friends

The most surprising thing here is that your friends have fallen out with YOU!

Gross misconduct and a huge breach of privacy. Don’t feel bad, it was her actions, not yours, that landed her in trouble.

I wouldn’t feel guilty if she’s done that to you she deserves it and you have just stopped her doing that to every single person she knows. It’s unacceptable.

But she deserves to lose her job! It’s gross misconduct and possibly illegal. If she does lose her job it’s her fault not yours.

Did they say they would come back to you? I wouldn’t have thought they would- your bit is done, surely, i’m not sure you’d be privy to the outcome of their investigations as her employer.

She deserves to lose her job btw. It is made SO clear in this sort of work that you must not misuse access like that.

So what?

It's quite clear what the OP is saying no matter how she spells it.

OP you may not want Karen to lose her job but she really deserves to.

Not only has she accessed your records she has also passed that information on to others. She should lose her job.

In my area of the NHS, Karen would be taken without warning and shot to a meeting with her line manager and someone from HR. She’d have no notice of this.

They’d put the allegation to her, and she’d probably deny it. She’d be suspended on full pay and told not to discuss any aspect of the issue with colleagues.

A letter would follow in the post advising her of what was happening and recommending she has a union rep with her.

While she was waiting on her disciplinary hearing, the IT people would scrutinise her digital footprint at work - whose records she’d been in, if there was a legit reason etc.

Then when the meeting came, they’d put the evidence to her and take it from there.

She’ll lose her job as this is just about the worst breach of its nature. She’s been in a position of trust and her actions have caused distress - both aggregator factors.

She’s done for.

Your friends are horrible! I can’t believe they are taking her side on this.
Don’t feel guilty, if she’s loses her job then it’s her own fault. She shouldn’t be looking anyone’s medical records if it’s not necessary, to then go and share private medical information with others is disgraceful too.