Is this an NHS data protection breach?

[thearty1]

The other day, I had a phone call, from a very young sounding young man, claiming to be a student, training at my doctor's surgery. (The number he called from was one digit out from the surgery appointment line, so I assumed he was who he said he was)

He said he wanted to discuss historical conditions, and to find out where I am now. He then dug up something that happened to me in 1989. An incident that was so traumatic, that I had to move schools at the time and undertake hypnotherapy to try and erase the memory.
I was fortunately strong enough to move on, and I put this behind me nearly 30 years ago. I've not thought about this since then.

I've been a f*ing mess since this boys phone call. I feel violated, devastated and I'm so angry that this has been shoved back into my face in the most cruelly callous way. I was at work when he called me. It was only by chance that I didn't have the call on speakerphone, as I often do. Thank god I didn't.

Firstly....I did not give permission for students to access my personal health records.
Has my doctor's surgery acted illegally by allowing this boy full access?

Secondly... I didnt' think they had records on file from that long ago. No doctor, or midwife, etc has ever brought this up before.

Thirdly....This student boy also wanted to know more all about a current, rather embarrassing womens condition, which I'm being treated for privately, because his surgery decided it didn't warrant NHS treatment. It's deemed to be more cosmetic rather than medical. I absolutely understood and accepted that, and i was happy to go to a private clinic elsewhere. I am aware that the private clinic do pass my records to my GP surgery. BUT I do not wish to discuss this with anyone else other than my doctor who is treating me, and certainly not student boys ringing me up randomly whilst at work.

Since this phone call I feel so angry and so sick.
What should I do?

I don't understand how mooncup's post (concurring it could be a prank) was considered cruel.

I'm sure I read a thread about this exact thing happening to someone else before on MN.

I've just spoken to my DH whose a dentist, he said the man who called was probably a trainee Gp (qualified dr though) doing an adult and contacted you to get some more info. He said he prob went about it the wrong way and I completely agree it's completely out of order they must of realised it would be traumatic to talk about. If this is the case I would ask a note to be added to your file to not discuss previous medical notes- I mean it's just common sense in my opinion to not contact tbe pt to discus an upsetting scenario and I would be very upset and angry too xx

Where does it say the caller was 16?

It doesn't. I think someone made a strange assumption that medical students might be 16.

Best to keep a record of the time they called which I'm sure you'll have if it's on a mobile or you can get your phone records from your provider at a cost. Not sure about students accessing files but no one - not even a a qualified doctor - should be calling you up out the blue asking about old injuries/traumas. I wouldn't seek legal advice yet as it could be someone trying to pull a fast one. It may look like their number but the lengths these fraudsters go to are unreal like you wouldn't believe. Then again it could be a student with no idea re data protection! Either way you should deal with this ASAP.

Don’t assume anything about the number or whether or not it’s a windup, OP. Call that number today.
I agree with pp above that this is more likely a hacker/ prankster than a student, due to the nature of his enquiries.

A hacking is a little far fetched imo, more likely to be a spectacularly inept medical student who has massively overstepped his boundaries.

You've been given good advice to speak to the practice manager, if you are worried about the integrity of the receptionists it might be better not to include the details in an email, ask for an urgent meeting and discuss face to face.

I would either conduct everything over email, or take a trusted third party with you.

I once had to speak to a practise manager because a fucking stupid receptionist phoned up telling me off and calling me lazy for not registering my daughter at their practise yet and they had notes through for her from the hospital. She even said "is that Emma's mum" when I answered the phone.

Emma had died when she was 2 weeks old.

The practise manager merely told me that I was irrationally upset and offered a doctor's appointment for me to get anti depressants and told me how upset the receptionist was.

I took it further and got my apology but the practise manager was pretty awful, stuck up for her staff and made me feel worse and I didn't feel strong enough on my own to say much. I wish I had done it in writing or with a witness.

Why on earth would it be a hacker? Why would someone spend time accessing records and mirroring a surgery number, just to cause distress to someone? It would be bloody tricky as well!

It probably was a student who assumed they were using their initiative; but they were hideously in the wrong. I hope you are okay OP, and get to the bottom of it.

@Puggles123, people get their jollies from all sorts of weird things, so it wouldn't surprise me if someone put in some effort to be able to have intrusive conversations under the guise of medical interest. Having access to people's medical records and contact details probably also has financial value somewhere.

Plus it's just so far away from what any student should be doing on their GP placements, using initiative or otherwise, that it made me wonder what else could be going on.

Did you phone the practice manager, OP?

I’ve been wondering how OP proceeded with this too. Was such a distressing thing to have happened; and it never should have happened at all.