Gross invasion of personal privacy by neighbour

[gldd]

Hi everyone, I wondered if I could ask the thoughts of the Mumsnet community on a sensitive issue regarding personal / medical privacy. Around 1 year ago my wife and I suffered through a positive NIPT and then scan confirming severe chromosomal abnormalities 12 weeks into our pregnancy, followed by an extremely upsetting medical termination. We are still dealing with this loss and its associated sadness with the help of a professional counsellor. My wife is a private person and has chosen to share this information only with a counsellor, family, and close friends.

Last week during baby loss awareness week we received through our letterbox a handwritten note from one of our next-door neighbours commiserating my wife on her loss and explaining in some detail our neighbour’s past fertility problems (she now has two small children). This neighbour, who is not a friend (we only very occasionally see her and say hello) works part-time as a receptionist at our local surgery. Earlier this year, for a number of reasons including the fact that our neighbour may view our confidential medical records, my wife decided to move to another nearby surgery. This neighbour had clearly accessed my wife’s (or my?) medical records, presumably has shared the information with her partner and mother (with whom she lives for now), and then decided to write my wife the message.

My first reaction was shock that a stranger could access and share what I would consider to be the most intimate and private medical information. Surely this is in breach of surgery rules, medical confidentiality, or even the law, especially given GDPR? A friend we have shared this with is of the opinion that it constitutes a sackable offence. At the time, my wife was also shocked (and upset) but perhaps more forgiving and so wrote a brief note thanking her for her concern and thoughts. Obviously, it would be very difficult to be on bad terms with our immediate neighbour. I can imagine them taking offense quite easily. In recent days and thinking about it more my wife has been very upset at the breach of privacy, at the reminder of our upsetting experience, her uninvited unburdening, at the thought that our near-neighbour nosed through our records without our permission, and at the fact that although the note was thoughtful in a way, was actually far more about our neighbour and about her difficulties. Perhaps it was a way for her to process her own experiences?

We’re wondering what next steps to take and would be interested in thoughts. Has anyone had a similar experience? Can anyone advise on the legal position here? My wife and I have discussed it at length and my wife feels that it would be too upsetting to bring it up herself. Neither of us would want our neighbour to lose her job, however surely I should bring this up with the practice to ensure that safeguarding procedures are in place, that medical information is confidential and kept confidential, and that this would not happen again? I have decided to leave the practise myself. I’m also thinking of raising it with the neighbour, though that will be a difficult conversation. Should we leave it and put her mistake down to the foolishness of youth? I’d be interested in everyone else’s thoughts.

Thankyou

It is gross misconduct and a sackable offence.
If your wife doesn't want to report your neighbour I'm wondering f you could not have a word with her and tell her you are considering reporting her for clear breach of GDPR.
You don't have to report her but she needs to know that this is totally unacceptable.
Personally I'd report her, this is a very serious breach of confidentiality and how do you know she isn't spreading everyones personal medical history about town.
I work in the NHS and if I found one of our staff doing this I'd put a stop to it immediately, she MUST know it's not acceptable, they have training.

I'm so sorry you've been put through this, but she sounds creepy AF! It sounds like a thinly disguised power game IMO.

If you're not already friends with her then you've got nothing to lose. I wouldn't want to make anyone lose their job, but I think a note through her door explaining the professional boundaries she's crossed would be a very good idea!

If she has admitted it then she really needs to leave her job. Just show it the manager.

I worked with far less personal information but signed the official secrets act. Mo chance of stumbling across data of anyone I knew. But I knew if I did access data that I didnt too ( I had to access data all the time as it was part of my job but as required. I would go to prison in some circumstances if I divulged personal info .

I have trouble believing anyone could be so incredibly stupid if I'm honest. It would have been in her very basic first day of training. I just believe anyone would do that and admit it I writing after being drummed into their head that it its illegal. Why would she do that?

The thing is, sometimes people should get the sack. Not everyone is suited to every job. This is something she had to have known was wrong, yet she did it anyway. That's not the kind of person who needs to be privy to extremely sensitive information!

The only reason I'd hesitate to take action would be if she's going to be living there for the foreseeable future, you don't want to move, and there's no way to report it without her knowing it was you. I'd worry that I'd make things worse for my own family, but that's it.

I am so sorry this has happened to you.
She needs to be sacked. This is gross misconduct, breach of confidentiality and GDPR, DPA. Whatever her intentions they were misplaced and unacceptable.
First thing I tell my staff is confidentiality is king. You breach this and you're out the door. Accidentally or incidentally viewing a record is one thing - reacting / disclosing as a result is totally unacceptable. Sorry.

your choices are to:

forget her dreadful behaviour and move on

report her to the practice and she will be sacked

speak to her directly, point out that you could have her sacked, that her behaviour was crass and hurtful and that your situation and grief is absolutely none of her business and she should not be such a fucking idiot.

I am also really disgusted and outraged by what has happened (and also very sorry for your terrible loss.)

Some people are saying 'she may have heard it from someone,' and 'people gossip' even with no ill intent, and so on, but IMO, if she works for the surgery, of COURSE she has accessed your records. Maybe accidentally, maybe deliberately, but yeah, it's unlikely (IMO) that her knowing all this, was just by chance or pure hearsay.

Sadly, I have known of several instances (in the fairly recent past,) where someone I know (acquaintances,) have stumbled upon personal and sensitive medical information, OR deliberately sought it out, and have blabbed to people what they saw.

It's a disgusting thing to do, and it was reported, and these people got their well deserved just rewards, (disciplinary action, and in a couple of cases, the sack.)

If I were you @gldd - or your wife - I would be absolutely mortified, and would feel like demanding to know how she found out this information. And if she accessed your medical records, WHY she accessed them. And who else has she spoken to about it. Nevertheless, I would not speak to her, and report it to the surgery tomorrow.

How could someone be so stupid as to access someone's medical records (when they are sworn to secrecy as part of their job,) and then go and discuss it with the person whose privacy they have violated?

I would not let this go, neighbour or not. You need to complain to the practice. Do it tomorrow. If you don't this woman will keep doing this kind of shit. What else has she nosed at, and who is she discussing it with? If she gets sacked, well, that's her own fault. She MUST KNOW this is not acceptable what she did.

You absolutely need to show the note to the practice manager. What the practice manager decides to do is then up to her.

However your neighbour will have been told on day one, and on numerous updates, that she is not to go looking at people's confidential information and if she does know stuff about people she knows, she keeps that to herself. It's fucking basic.

Ask the GP for a list of who accessed her records around that time. (You are allowed to ask for this.)

You need a valid reason to view a patient record. Even if she had seen it accessing the record for valid reasons, you keep what you see to yourself.

Personally I'd put it down to poor judgment from her but ultimately she was trying to do something kind.

@maryberryslayers you are totally wrong to take this so lightly. Confidentiality in medical settings is an absolute must. I can't believe that you think this can be excused because she's 'trying to be kind'. Every single person who sees their doctor for any reason at all should be able to trust that NO-ONE in the practice will break confidentiality.

I would be absoutely furious. Anyone working in the NHS will know that this is a sackable offence, and so it should be.

OP, sorry for your loss.

Please write to the Practice Manager (email will do - it just has to be written) and make a formal Subject Access Request on who has accessed your records in the time period concerned. Their computer records should have an audit trail. If it were a paper letter that was being scanned in by the neighbour, then it will show the person doing the scanning and a date/time stamp. The practice has a legal obligation to reply within a set time, and that will give you the rest of the evidence needed if she accessed your records.

Then you report the major breach of confidentiality to the surgery. They are legally obliged to report it. Look at the NHS Digital DSP (URL below) to see if they have completed all the proper information governance for a healthcare organisation. They should report this breach through that portal, and then onwards to the information commissioner's office.
www.dsptoolkit.nhs.uk/OrganisationSearch

Agree with Jynxed. We are trained in the NHS not to even reference that we have seen someone in a clinical setting if you happen to bump into them / their family at the pub.

If you bring this up with the practice and the neighbour is found to have accessed your wife’s record (they are able to trace this) then it will be a sackable offence. It is an incredibly serious breach of her position - I would suspend a member of staff immediately, until the matter had been investigated, if I received such an allegation (I work in healthcare). I’m not saying this so they you don’t raise it, but just so you are clear on what will happen if you do.

This is very difficult. It sounds as though she saw the information in the course of her job, and knowing it was baby loss awareness week, she has reached out with goodwill. She's definitely in the wrong.

I think I would approach her directly, and be honest with her.

NHS staff shouldnt be discussing someone they know even with their family and if it cam out that would still be a sackable offence. To write to your wife in that way should get her sacked immediately.

As she is your neighbour I appreciate you may not want to get her sacked but it is your choice,

Should we leave it and put her mistake down to the foolishness of youth?

Absolutely not. Because the next time she breaks a patient's confidentiality it could be even worse.

I don't believe for a minute that this is the first time, or will be the last. And I would be very surprised if she didn't gossip among her friends. Next time it could be a patient with a mental health issue, or who's attempted suicide, whose medical history is shared.

You owe it to other patients at the practice, to report this.

Very sorry for your loss and I can totally understand the sense of violation this has caused you, never mind the potential breach of your medical privacy.

I think, however, that you would probably be best letting it go. You can't be totally certain that she obtained the information in this way, if you falsely accused her she would be in all sorts of trouble at work and it would lead to a huge problem with her.

I think its also worth recognising that however inappropriate it was, it was meant well.

I'm sorry, I can totally understand how angry you must be but I think complaining and investigating it would escalate the situation in a way which would make it far more painful for everyone.

One of my colleagues was off work for a week or so. When she returned she started waxing lyrical about how lovely my daughter (a nurse) is. It turned out she'd been in hospital for an op, and my daughter had nursed her (my colleague saw her name tag and recognised it as my daughter's name). I had no idea until then.

I told my daughter what the colleague had said, and my daughter said nice things in return, and said that of course she hadn't been able to tell me that they'd met, due to medical confidentiality.
If a nurse can't even mention seeing someone in the course of their work, the posters who are trying to pretend that the situation in the OP isn't all that bad because the neighbour meant well, are away with the fairies.

This is appalling. A medical secretary or receptionist HAS to be confidential, it's a major part of the job. A friend worked as one whilst a student, and they were trained in this, years before GDPR. However she found out the info at work, she should never mention it to you, or any other member of the public who doesn't need to know.

She could be doing this with people's STD results, mental health etc... and cause untold damage. She can't be very bright because (1) this is gross misconduct and part of training and (2) she actually admitted it in a note that she saw the information at work. She clearly doesn't see how wrong it was, which would suggest she might do it to other people as well.

I work with confidential data, and this would be a sackable offence.

I’m so sorry

That’s such an invasion.

My nhs friend accessed a record of someone brought into casualty to see if she was still there as she would give her a lift home if she was needing one.
She was sacked for accessing records. Even though to this day she doesn’t know what the person was in A&E for. Only that a mutual friend/colleague said she was in. The person complained when she heard so presumably something personal as she wouldn’t care about a broken toe being common knowledge!
She subsequently withdrew her complaint but it made no odds as once the nhs wheels are in motion procedures have to be followed.

I agree your neighbour was well out of order and should be in big trouble. No matter how well meaning her note was. It wasn’t her place to read stuff while filing it.

However I don’t know how comfortable you would feel knowing that you got her sacked. Especially now when jobs are so hard to get. She may have a mortgage or children or be a single parent.

If she wasn’t a neighbour I’d say write and complain to the practice manager. She brought any disciplinary action on herself. But in these circumstances it’s not so cut and dried. You have to live near that person.

Oh that’s very dodgy OP, I would really think on approaching her employer. It’s not on at all!

I think you are focusing too deeply on this.

She admitted she came across letters she had to file, this is part of her job and lots of non clinical staff have access to clinical information.

It obviously touched her as she had similar troubles but then went onto have two healthy children.

She wrote a letter to offer sympathy and this supportive message.

Yes she absolutely should keep everything she reads to herself and she definitely should not have let you know she knew. That said I don’t think she did this from a bad place.

It should have been dealt with at the time by approaching her and saying you don’t really feel comfortable that she was discussing something with you that she has read in confidence.

Complaining to her practice will get her disciplined and will lead to difficult neighbourly relationships, particularly after your wife thanked her!

I think OP it comes down to what you can live with. (The letter proves she’s in the wrong, that’s not up for debate whatever her intentions were.) But.......Can you face this woman on a daily basis knowing what’s she’s done? I totally understand not wanting to create an awkward environment so that’s what it comes down to, for me. If you can nod and smile and ignore then good luck to you but if this is going to fester and bubble over why not just deal with it now?

I suspect your wife was in shock initially and now that it’s worn off she’s rightly angry. Is that likely to resolve without action?

@gldd

She could not have found out from anyone we've told as none of them live nearby and we've been very private about this. She wrote in her note '... since I worked at xxx surgery I had to open and file letters / documents of yours...'.

We spoke with a GP friend of ours who said that anyone in her position who comes across confidential medical information relating to someone they know should be recusing themselves immediately, handing it to a colleague, and certainly not sharing it.

Wow! I’m totally shocked. She obviously 100% deserves to lose her job.

I get that reporting her and her losing her job would be very hard as you are neighbours. If you tell the surgery then something must be done. They can’t overlook that.

People never fail to shock me. I honestly didn’t think from your first post that she could possibly have been that stupid.

GDPR training in my org is annual, plus we sign an annual declaration, plus if someone we know comes up on something we are working on, we have to alert our line manager, and in most cases recuse ourselves, handing over to a colleague who doesn't have that personal connection.

She must have literally slept through her annual GDPR training.