What would you do if you got a copy of someone else’s confidential GP records

Phew, so they got away with it then. Yeah; I bet the GP was very grateful.

I know that’s sarky of me, but this is how the NHS gets away with shit like this, people don’t make them take any responsibility.

It happens more than you think. Let them know about the error and return the paperwork.
Not ideal, but it is a human error.
I wouldn’t report above calling the office.

You might not want to be told but the person whose informed was leaked might have thought differently. In your place I would have sent the document to them and let them decide what to do.

It's a huge data breach. Why do you think there is legislation about this? Why do you think the Information Commissioner's Office exists?

This happened to us, we were sent a child's health records several times, despite contacting the hospital each time as our address was similar and the postcode was the same. Was very difficult as the child was in care, at our local school, and was being treated for an incurable and transmissible disease (think hepatitis/hiv seriousness ) which wasn't disclosed. Obviously we didn't say a word but I was always worried in case another child contacted it from a playground accident

So I called the GP surgery and the doctor called me back (not a recorded line as I specifically asked). I explained what happened and I will admit I did say “I haven’t shared this with anyone and I will not report it to the ICO but I some internal training so this doesn’t happen again maybe in order” I then left the records back in a sealed envelope half an hour later marked for the attention of the GP.

I don’t think they reported it as the GP was extremely grateful for how I had let her know.

It’s such an easy mistake to make. If it were my records (provided it didn’t end up online or copies being made) and it was handed back to the surgery I wouldn’t even want to be told

No, this has happened to me. I was delighted that I found out. Equally, I was the recipient of another family’s highly confidential information (Child Protection report). I handed it over to them at their home as it had their address on; their solicitor was very pleased. I hope the family was compensated appropriately by children’s social care. I flagged it up to the local authority’s information officer; I was bombarded with emails asking if I had destroyed the document. I realised that all they were concerned about was not having to report the breach to the ICO. Not about any potential distress or shame to the family. Apparently, if you can demonstrate that any breaches have been mitigated, then it’s not reportable. Sod that. Children and families deserve better.

It absolutely did. He still has the emails to prove it.

This happened to us, we were sent a child's health records several times, despite contacting the hospital each time as our address was similar and the postcode was the same. Was very difficult as the child was in care, at our local school, and was being treated for an incurable and transmissible disease (think hepatitis/hiv seriousness ) which wasn't disclosed. Obviously we didn't say a word but I was always worried in case another child contacted it from a playground accident

So I called the GP surgery and the doctor called me back (not a recorded line as I specifically asked). I explained what happened and I will admit I did say “I haven’t shared this with anyone and I will not report it to the ICO but I some internal training so this doesn’t happen again maybe in order” I then left the records back in a sealed envelope half an hour later marked for the attention of the GP.

I don’t think they reported it as the GP was extremely grateful for how I had let her know.

It’s such an easy mistake to make. If it were my records (provided it didn’t end up online or copies being made) and it was handed back to the surgery I wouldn’t even want to be told

A huge data breach would require 000's of records to be compromised, and generally requires that leakage to be digital.

It's a minor cock-up.

When you talk about ICO and need for serious investigation etc, you also need to think of being proportionate.

Have you ever thought that the NHS is struggling and that the nett effect of such an action for a single data record would affect the availability of services to other patients.

Because they could’ve ended up being reported to the ICO and facing some pretty awful punishments. Think the other guy got compensation too

It's a huge data breach. Why do you think there is legislation about this? Why do you think the Information Commissioner's Office exists?

"Because before the digital days, written house deeds were proof of ownership"

But you said he still has the emails, so this isn't from a pre-digital time! There's no way a bank wrote off a 50k loan AND gave compensation for accidentally sending a set of deeds. Banks don't throw away that kind of money as a thank you!

That’s not how it works, I’m afraid he told you a porkie. A fine isn’t issued just because of an error. Systematic errors, failure of procedures, lack of adequate procedures, ongoing inadequate security, inadequate training, basically things other than human error, would be needed to mean a fine was possible, unless that human error had resulted in pretty damned serious harm. Especially if this was pre-GDPR enforcement, when the ICO was fairly toothless.

It was probably a stressed out receptionist who accidently fired it in a brown envelope. Yes not ideal but with all the ridiculous pressure GP surgeries are under do they really need the ballache of dealing with an admin error?

I have no doubt the GPS will have highlighted it and changed the practice so it doesn’t happen again going forward but what would reporting it actually achieve?