I’ve reported my friend for an NHS confidentiality breech

Don't feel bad. If I had someone done this to me I would have gone absolutely ballistic and complained too. I actually felt violated when reading on your behalf as it would be such a shit thing to happen.

I work in an NHS hospital. I would never even mention that I'd seen someone in the hospital (e.g. I wouldn't tell my Mum if one of her friends was an inpatient). It's confidential information, we all know it's confidential information and your friend deserves to be sacked for her stupidity, numbness to your feelings and arrogance when confronted.

No, she’s not at all. That’s why I asked (and I see at least one other poster has). It’s not clear what prompted her to access the records of the OP or the friends she’s apparently done this to before. If she is regularly scanning their records on spec, that’s pretty large scale. If she sees their names on a clinic list, and draws conclusions, then her lack of confidentiality is still a serious matter, but she may not have accessed their records so an audit won’t show that.

What has triggered her to look at your file, OP, and that of others?

If they can prove it they will probably fire her. I'd expect that she loses her job and quite right.

If it was physical notes she looked at (less likely) she might deny it and get away with it. Or there's a small possibility she's looked at your record on someone else's log in. And then it will be harder to prove it was her but would look suspicious if there was someone who had looked at your record with no reason to and they work in the same dept/are known to your friend.

Dont feel bad. She doesnt deserve to be in the job if she has no regret or remorse for what she has done. Regret because shes facing being fired doesnt count.

You don't need these friends that can't see whats wrong with what shes done.

No, what she has done is worse. You’re only supposed to access notes in the course of your business, so if she was booking an appointment, etc. if she had no reason to go into your file, then she shouldn’t and then to tell others about it.

It doesn’t long to audit a file. I would chase it up.

Oh hellllllll no!! (Previous NHS worker here) Do not feel bad at all and I cannot believe your friends are taking her side? Doing this is a massive NO! I hope she loses her job, she has absolutely no right doing this! I cannot stand how people think they have the right to access a friends information AND THEN TELL PEOPLE!!! You did the right thing, congratulations on your pregnancy x

As the pp said, electronic medical records have an audit trail of who has viewed them (every member of staff has their own identifying network login).

For example, clinicians (are meant to!) do a monthly audit of their case loads to see who has viewed their patient's record, and report any unfamiliar staff name for investigation. Electronic applications have flags too, if you search your own name for example. Confidentiality breaches are taken very seriously, if you're proven to have breached same it is gross misconduct and dismissal.

Your friend may have viewed a physical record, in which case it would be hard to prove (unless she admitted it). If she's been shown via audit to have viewed your electronic record, she may be in the process of disciplinary action/dismissal (there's no warning for a clear breach, it's dismissal) but could remain suspended for a time while paperwork to dismiss her is completed. I've known this type of thing to take an age, if an employee cites health reasons and such like to avoid attending disciplinary hearing.

This is on her not you.

My mum works in NHS admin and I remember years ago a colleague of hers was fired for looking at a relative's file (without their permission and for no reason other than to nosy). I remember my mum saying it's the first rule they're taught. And it's just pretty basic morally isn't it. Decent people don't nosy in others medical files and then talk about them!

Your friends being mad at YOU is shocking. You need better friends OP.

I used to work for the NHS - its made explicitly clear that clerical systems are not to be abused by looking at personal information of people you know - its gross misconduct and the likelihood is she will be sacked because it is illegal.

It's a data breach of GDPR and the trust will have to report this incident to the Information commissioner's office (ICO) and get a reference number. Then they should write to you OP with that reference number and the results of their investigation. They will also need to explain how they will prevent such a thing occurring again.

As for the "what's the harm" bull crap - I imagine you wouldnt want your GP receptionists gossiping about your private medical issues to all and sundry would you?

This happened to me once - when my kids were at primary school, my dad got dementia and went into a nursing home. The manager of the home was another parent I used to see at the school gates. My kids came home one day and said her son had told them their grandad was "mad" and they were very upset. This woman had clearly been giving her son updates about my dad's condition. So you can fck right off with your "what's the harm" BS. There is plenty of harm when confidentiality is breached.

She will definitely lose her job, yes

This! Confidentiality is drummed into you when you work in a medical setting. She was out of order.

Tbh, they all sound thick to me if they can turn a blind eye to this and you’re better off without them OP.

My medical records would make for a very interesting read to your ex friend, including one near fatal mental health crisis and a history of severe mental health only close family and oldest friends know about.

The others might feel differently if they’d had an abortion or something like this, for example.

She deserves to lose her job. Breaching GDRP is very serious and patients rely on us to protect their privacy. You can't have people doing this ......ever.

I'm totally with you - beyond unacceptable. Can you imagine if she was saying 'oh be careful near JOE because he's got HIV' or 'csn you believe Sarah's child has another uti' etc etc its just as bad

@BundleOfCookies
I applaud your brave decision.
I majorly applaud that you revealed to "Karen" that you'd outed her indiscretion(s) ... you did say that she kept track of several people in the frienship group.
It's tough on you that you've been cut off. But their severing of you is a commentary on their mixed ethics and appalling moral compasses.

Yes, they are on the national spine.

100% right thing. My mum used to work at the same drs as me and a lot of my friends. I can remember being like oh so and so has this (she used to do the drs letters) and never ever told me, sometimes she would say after I mentioned something like oh I’m glad you know now. But she would never mention anything it’s part of your job! She was wrong and the friends are wrong too

All your notes aren’t held in one place. So a booking appointment with the midwife, which would have been arranged via a GP, would not be recorded anywhere but on the GPs files. Even if it was recorded, the details of that appointment would not be.

Just trying to work out what her friend would have been able to see, as that is dependant on which bit of the NHS she works in. From the OP it looks as through the friend had seen a lot of detail, not just an appointment.

She really ought have known better. You've done nothing wrong.

On her head be it
she looked up personal information which is a breach of GDPR
and the friends who are backing her are idiots
you did the right thing OP .who knows whose notes she’s been looking at as well as yours

What she has done is awful and she SHOULD lose her job. Maternity notes are particularly sensitive due to the nature of what you have to disclose during booking - your entire family history, your mental state, abortions, STDs, domestic violence, drug use, sexual assault - they are far more intrusive than your normal file.

If she has accessed your notes digitally there will be proof as she’ll have had to be logged in to do so. This will mean, especially if she has indeed been doing it lots, that she will likely be sacked for gross misconduct. This is in no way your fault - it’s all on her.

I'm not convinced there was any harm done here,

It undermines trust in the NHS and the confidentiality of their systems. That’s a huge thing and, as a pp said, can have very harmful consequences if people won’t seek medical help because they lack that trust.

Contrast this with an example I had this week: my DD’s ballet teacher broke GDPR rules this week as she sent out an exam timetable to us with all the children’s full names and RAD numbers visible. That was a) done in the spirit of being helpful so that everyone knew timings, b) wasn’t information that anyone could reasonably think of as deeply personal and c) was likely an oversight on her part. In the OP’s case, her “friend” Karen was basically driven by a prurient interest to find out her friends’ secrets and was done deliberately for her own personal advantage. Totally, totally different. It’s an egregious breach of the rules and she should lose her job, if for no other reason than it’s a pretty big disincentive for anyone else in that position of trust to obey the rules themselves.

It's unlikely you will be told much due to (ironically) confidentiality.

You are more likely to get more information from your friends. Who are crap first falling out with you over this.

I’d be pointing out to your ‘friends’ she’s read their medical notes too - they will soon switch sides.