Data protection breach at drs surgery - compensation?

Do you know this lady op. Personally In your private life? I’m trying to work out why she did it.

amd yes. Comp is fair. And yes you should treat yourself with it. Or your babies.

I think it’s awful if the person who divulged the information doesn’t lose their job. It’s a sackable offence, and they should lose it. It’s not the same as an accidental recording in the records, it’s deliberate.

Maybe even ask a representative to take it over for you.

If you remain dissatisfied after the Practice’s investigation (which you may not) you can complain to the ICO and then the Public Service Ombudsman.

In terms of what remedy would be available it would be primarily financial remedy. There are some very naive posters on here that don’t seem to realise that the NHS pay out billions in compensation each year. In terms of the person at the Surgery who leaked your information it is unlikely that they will be sacked although this kind of security breach is taken very seriously. You probably won’t find out how she will be impacted as that is her personal information.

Good luck. It seems to me that you are entitled to compensation and will likely be offered some but don’t get too emotionally sucked into the complaints process as it can take a lot out of people.

Yes you are. I posted earlier up the thread about this, stated by the Information Commissioner's Office:

The GDPR gives you a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law. This includes both “material damage” (e.g. you have lost money) or “non-material damage” (e.g. you have suffered distress).

OP the best thing to do here is to seek legal advice from a recommended solicitor or perhaps from the Citizens Advice Bureau. You really do need information from a qualified professional rather than an internet forum.

I'm sorry you have gone through this.
Your confidential information should have remained confidential, and not used as some inside gossip between pals. Disgusting behaviour. 😡

I hope your complaint was taken seriously, and the receptionist has been sacked! 🙏
I would never have claimed compensation, but in this case I think you are right to do so.
If you like a PP said, do indeed need it for therapy, or if you wish to donate it to a certain charity etc then you do what you think is best. 💐

I told my husband about this thread and his response...? They won't take it seriously unless she hits them in their wallet. - enough said. 👏

Wishing you the best. @peony90

Talk about victim blaming. IF any compensation is coming from the nhs/taxpayers that's on the person who breached ops data, not op!

Claims are usually handled separately via bodies established (eg NHS Resolutions) it’s not the GP funding it personally.
plus this mythical free hour with a solicitor - you won’t get anything useful for free. I recently spent hours on the phone trying to find someone to speak to and ended up paying £800 plus for a merits of claim (which was still just an outline of the relevant law and not any indication of merit, which would cost more)

I think compensation is appropriate in this case actually, and I think you should spend it on counselling to help you move on from it. What a terrible thing to have happen, I’m so sorry

I’m outraged on your behalf. How dare anyone in a position of trust trawl through medical records for malicious tittletattle.

Ignore the posters that say compensation won’t help. Money or the thought of losing money is the only way organisations will become more compliant with legislation

I Hope that person is no longer working for the NHS

No, I’m not.

OP this is awful, so sorry your private medical information has been breached in this way. I hope the surgery sack the member of staff concerned after their investigation.

Have they (the surgery) offered you any support during this upsetting time?

It is gross misconduct and the person involved should be disciplined for inappropriately accessing patient records and breach of confidentiality. GDPR normally applies to incidental sharing of personal data, not deliberate actions, but you can make a complaint to the practice data controller and ICO and be compensated if appropriate.

A medical receptionist will access 100s of patient notes per day and not just for booking appointments. These tasks may not be linked to an appointment. I really don't see how you could limit their access. Other staff members possibly, but not this role.

Patient records systems do keep an electronic audit but unless this person was searching on days they were not working or repeatedly searching for the same person it would be difficult to pick up.

Ultimately we have to rely on training and trust. GP staff often live in the area they work in and so this shoukd be drummed into them. At a recent information governance training session at my trust, we were told that 5 people had been dismissed that year for accessing records when no need to do so. If the practice can prove the staff member had had appropriate training, I doubt they will be deemed at fault.

In this case, money could help. Private therapy, extra childcare, even a holiday could make a difference to your wellbeing.
I hope you get compensation. Remember you have done nothing wrong and this receptionist should be feeling ashamed, and the surgery who did not train or monitor her sufficiently. Not you.

Yes, seek compensation.

Mainly because doctors surgeries won't take this seriously enough unless there is some sort of financial consequence. The inconvenience of an investigation and finding a new receptionist isn't really enough. Perhaps their insurance premiums getting a little bit higher as a result and their surgery profit a little bit lower will help concentrate their minds.

People will bleat on "... Oh but the NHS" but if they just get away with that as an excuse every time they won't get any better.

I think getting compensation from them is the only way to make them suffer and learn, they won’t learn from a rap on the knuckles. My son has a claim against the NHS for the unnecessary death of his wife, the ambulance service admitted liability 3 years ago at the inquest and to date nothing has been settled, so don’t hold your breath.

OP I am so sorry for all you have been through. I would absolutely seek compensation in your shoes and quite frankly I wouldn’t donate it all, I’d use it to do lovely things for myself and with my family. I’m no expert but it’s my understanding that GDPR breaches incur big fines, you should be entitled to something and I hope you get it.

Money aside (as it’s clear that’s not the most important part of this for you) I hope you can in time start to move on from what this awful, spiteful, brainless arsehole has done to you.

Hold your head up high - you’re not the one who has done anything wrong.

You are misinformed.

Yes, you should seek compensation. It’s not just about financial losses, it’s about the emotional impact that has had on you!
im so sorry for what you’ve been through and that someone in a position of trust has done this ❤️

You need to produce evidence of quantifiable economic losses.

GPs are not technically part of the NHS. They contract to it. I'm surprised your aunt didn't mention that to you.

When looking at the legal routes, you need to consider that. Ask the practice for their data protection policies if you've not been given them yet.

OP asked WWYD.
I would pursue an apology and getting the culprit fired.
I would not seek money.

She clearly has suffered losses - it’s exacerbated her existing mental health conditions for a start. Whether it’s worth pursuing, because of the arduous process, is a separate issue.