Data protection breach at drs surgery - compensation?

Have you spoken to ico? She should have been sacked for gross misconduct.

I don’t think you’d be likely to get compensation. I’m sorry this happened but compensation in the UK isn’t like in the US. You’d need to prove you’d suffered losses due to the data breach

Are you the receptionist? Disgusting comment after what she’s been through have some compassion!.

OP you have every right to seek compensation what she did was disgraceful hopefully she will lose her job. Makes you wonder how many more people she has done this to.

I’m so sorry you’re going through this. If I knew you and heard this I’d be admiring your strength to go though such pain and get yourself to a place you want to keep living. I’d be judging the receptionist and my negative thoughts would be reserved for her.
i can only begin to imagine how upsetting and unsettling this has been.

I am so sorry these things have happened to you - by that I mean both the sharing of your data but also your miscarriages and mental health struggles.

Claiming compensation in the NHS tends to elevate the seriousness of the issue and they deal with it quicker and with more lasting emphasis. If the GP surgery is a private partnership though I am unsure how far this will go.

I would absolutely claim though - in your current situation that money could help extend maternity leave, get you some regular childcare so you can have a break and rest and improve your current MH, or maybe pay for a holiday or break (for you, holidays with young children are no picnic 😂).

Good luck

There’d be a psychological assessment as part of your claim that would consider whether there was a “clinically significant” exacerbation and what the functional impact was on your life. The psychologist would read in detail your medical records as well to try and determine causation. Essentially, has the data breach led to the proven significant worsening of your mental health or could the the course of your PND symptoms have been expected to follow this pattern even in the absence of the breach given your psychological vulnerability and so forth. What other contributing factors were affecting you at the time etc. The claim might fund a course of therapy for any exacerbation in symptoms.

You might find the process of solicitors / experts pouring over your records and writing reports about you as intrusive a process as the breach itself. It’s a stressful and lengthy process sometimes, with lots of appointments. Litigation itself can have an adverse impact on mental health. I’m not saying don’t pursue it, but just be aware of the process.

Whilst it's not the fault of the GP practice that she is a nosy cow, I'd probably speak to a solicitor to see what they think in the first instance to see if you have a case. Honestly I'd hope she loses her job, karma has a way of dealing with such folk.

It may not be their fault that she's a nosy cow, but it is their fault in that they employed her and she was allowed to access patient notes.

I think you definitely have a case to pursue here @peony90 but perhaps consult a solicitor with medical expertise. Sorry this has happened to you and can understand why you're still upset

OP this is a serious breech of the NHS's duty of care, especially given how sensitive the information is and your circumstances.

I would seem compensation but please don't give the money away. You may need it now or in the future, eg to fund help with your mental health.

Please be assured, most people will not think you are a "psycho" for being an inpatient at one point, they will be sympathetic, and should be shocked at what this stupid receptionist did.

If I was friends with the receptionist who did this I'd report them immediately and they'd no longer be my friend. She is the one who should be ashamed, what an utterly stupid and unprofessional thing to do. She certainly should never work for a public body again.

Oh theres always one isnt there. How would you like your private medical issues bandied around town?
You should be ashamed of yourself. I bet you're a real nasty piece of work

I think you’re right to persue compensation, providing that doing so won’t be to the detriment of your health further. The surgery are more likely to ensure there’s not a repeat if this impacts them financially. This js a really severe example of a data breach, the person has actively obtained this information for the purpose of gossip.

I will say, this other person isn’t a friend though. I’m not clear why they told you in this way, or even engaged in the conversation with the receptionist in the first place. I would’ve shut that down, and I wonder how reliable this person is as a friend if they didn’t.

Why is it tawdry to expect compensation for injury? That's the only way corporations learn. Do you want your data accessed and leaked and then, "Soz," will be enough?

I never understand. why this misconception is so common on MN. Of course you can claim compensation in the absence of actual financial loss. OP. would be entitled to compensation for mental stress and suffering, and for the exacerbation of her known mental health problems.

That's not the same thing at all.

I am currently going through something similar where a person has put something false on my medical record. I found out by chance a couple of weeks ago, it occured late 2024. Compensation has not crossed my mind, I just want my medical record corrected and have said as such. I have an hour meeting regarding it next week. I think the NHS has enough problems, the amount paid in compensation is huge & sometimes deserved. My own sisters child suffered a preventable birth injury that will have lifelong effects. I have not suffered anything like a permanent disability, I wouldn't consider compensation. It just feels wrong. I don't want a fuss even though the surgery are taking it very seriously, I just want it deleted. Why do you think you deserve money? I dont think I do, yes it was a shock but I am not going to need physio, operations etc like my sisters child. I think you need to think, well I do that the NHS is taxpayer funded, we all pay. I fully support my sister as her child requires extra care, may never live independently she has been through hell. They actually asked her and her DH if they wanted resuscitation attempted. They are a bundle of nerves watching for any sign she cant do something eg hear (she can't 100%). Compare that to what one lone individual did to you and me, it makes you think who should get some of the finite money. I don't think I should. The person involved should definitely be disciplined, sacked I would hope, but you can't blame the entire NHS.

I used to work in hospital medical records department. This is illegal, it’s not just a lose your job type situation. Its a criminal offence and can even lead to a prison sentence. I would definitely seek legal advice.

OP I think compensation is a great idea. And you shouldn't feel obliged to give it all to charity. If the distress has made your PND worse or made it harder to enjoy time with your baby, hindered your social life or otherwise made things harder, then using some of it to have a time you'll enjoy will help to right the scales to some extent. Also, if some counseling over how you feel about what happened would help you move on, that's also a useful and important thing to spend the money on.

As well as the ability of compensation to help you get to the place you were at before it happened, getting compensation also helps put pressure on the surgery to put better controls in place. I have seen this sort of thing happen before. It's never a real surprise. Colleagues and managers overlook telltale signs of unprofessional behaviour because they don't want to go through the rigmarole of managing properly and ensuring the office culture is watertight. Having to pay out compensation or increased insurance fees can really sharpen minds around this sort of thing.

I agree

The money doesn't come from the NHS, most doctors surgeries are privately owned, they will have insurance for this kind of thing.

I know it's easy for me to say but don't let this lady take away from your recovery.

You have a strong relationship, two wonderful children. You've fought difficulties and come out the other side.
Don't lose sight of that because of what happened.

I don't think anyone she may have told will judge you. The judgment will be reserved for her and rightly so.

Seeking help and recovery us the furthest thing from "phycho" - it's brave and commendable and may give hope to others who may be struggling.

Talk to Irwin Mitchell. I'm not completely sure how it works with GPs as they are self-managed, but the NHS has a well run compensation section, well funded insurance, and nobody should be made to feel guilty for obtaining appropriate recourse.

I assume the board informed ICO? They will have their own punitive measures.

That’s not how it works. When you claim against the NHS (for medical negligence, for example), any compensation comes from NHS Resolution, which acts like an insurer. All NHS trusts pay premiums in return for cover in case someone makes a successful claim. They have to pay these premiums whether there are any claims against them or not, so OP claiming compensation will not affect the amount of funding available for direct services at all.

Alternatively, if the GP practice is a private company, they will have insurance that will pay out, again not affecting money available for NHS services.

Money sharpens things, giving it away hurts and should make the practice train their staff regularly and remind them often
of their duties and confidentiality and what happens after a breach.
for the OP she can keep any monies and use them for therapy like a PP said or to pass to a charity in support of a good cause. She can also keep and spend any compensation how she sees fit

Yes, you can get compensation for distress.

From the Information Commissioner's Office:

The GDPR gives you a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law. This includes both “material damage” (e.g. you have lost money) or “non-material damage” (e.g. you have suffered distress).