When is accessing an NHS patient record classed as wrong?

[Sp3849]

So I work for CAMHS as a secretary. My son who has autism was referred into CAMHS 18 months ago and I have heard nothing. I have rang and rang the doctors to chase and they say they have expedited it and can't do much more but I know a referral for mental health should not take this long. After asking colleagues for months to keep an eye out for his referral I was told last week after being beside myself because my son was so poorly by a colleague to check his file to see what the hold up is and if the referral had been picked up and we had missed it . Now this is a job I do on a daily basis. Parents always phone to check on referrals for progress updates for Thier children I really didn't think it would be an issue. How wrong was I! Had an email today and I am being investigated by information governance for accessing my son's health record. I have a meeting with my manager on Wednesday to discuss what I have done and I am not sure what to expect. As he was being referred to us surely I can check that referral? He would be a patient anyway. I didn't look at anything else or do anything else. It turns out when looking the silly g.p referred to the wrong service anyway and it was sent back last to year and go has done nothing with it

OP, I know what I wrote above looks a bit negative, but I really hope this goes OK for you and you don't lose your job.

When someone accesses a record in NHS, is it easy to see in the system? This thread has made me think about how I have a suspicion that someone I know who works in NHS accessed my records maliciously to snoop. Is there a service I can contact in NHS to check the system and see if my records were unlawfully accessed?

@Piratepirate yes they leave a digital footprint. If it's a hospital you need to contact PALS, for a GP practice it's the practice manager.

It depends what area they work in. Primary care records are restricted just to that surgery and letters that have been sent into that surgery, you can't have a nose around the wider NHS records system from there. If they're in a hospital it may be different. Mental health trusts tend to use a different system again.

When I worked for a GP surgery we were explicitly told we and our household weren't allowed to be patients at that practice.

In terms of access to records, yes they can see every single staff member who has accessed the records. Be it an administrator or Dr or practice manager.

I hope all goes ok OP. Sounds like you have a sympathetic manager and supportive work colleagues which is worth its weight in gold in situations like this.

There’s learning from everything!

This is a fair point, although perhaps it's also in your contract (I presume it would be). I've also worked in places where for commercial reasons you cannot email your personal email (instant dismisal), and obviously for all people you can't steal.

I agree. I find this all very disturbing, same with the colleagues attitude

You need to google the Caldicott Guardian for the organisation. It is often the practice manager in GP, but not always.
In a hospital setting it is not PALS. Go on the trust website and search for Caldicott Guardian. There will be a name, number and email.

All you can do is tell them what you've told us. The line manager brushing it off because it happens all the time has opened themselves up to investigation, that shouldn't be happening and there is a serious systems failure.

You can't even check your own records?!?

That's crazy! 😂

But how does the system programmed to flag up searches on people who live on the same street as you?

My way of thinking is that as a parent, we can do a SAR for our children's medical records, as I have with mine, so we legally can be given the records, so I don't see it as being an issue, like if it were for her sister, or best friend.

That's just how I see it.

It wouldn't be difficult for the software to be programmed to do this.

That is a massive data security breach. Definitely disciplinary, often dismissal. Get in touch with your union ASAP.

@penjil no of course not!

Then the OP could have done a SAR. What she can't do is use her employment as a way of bypassing normal protocol, which is what has happened.

Information governance training is quite clear on this. I'd love to look at my own but dare not.
Unfortunately ignorance is not a defence, I sincerely hope for your sake you just get an official warning and retraining this time.
Sites such as emis as we have in clinic here register every person who looks at patient information so there is a list of dates and times so if anyone is looking at it for malicious purposes you can find out.

@penjil it's not. Usually it's flagged after a spot check, so in this case someone in her team has gone to management. Or sometimes it's found by co-incidence, when someone has requested their records and then found that they had been accessed by someone they know.
And the system administrators can also run reports to see which records a member of staff have been in and out of all day. So if I wanted to see what my band 5 nurse had been doing, I could run a report and it would show me all the records she had been into, and what she had done in there (if anything). If they've just been in to read, it just says what time they went in and what time they came out.

I wasn't justifying what OP did. I know it broke protocols. I was just giving my way of thinking on why I think she probably won't get sacked for it (hopefully anyway).

tass1960
I was told by my manager on my first day about this - looking at any records with surname same as yours or even people who live in your street would be flagged up instantly - my friend checked her own record and it was flagged immediately and she was spoken to about it. Just a chat - no disciplinary - maybe slightly less controversial since it was her own record and not her son or other family member.

But how does the system programmed to flag up searches on people who live on the same street as you?

I have no idea 🤷‍♀️

Ok so after much thought today I am going to look for another job. For some clarity for people who can't believe my stupidity I have only just started this job. I have been in post about 2 months. I haven't had any training I did have one session on how to use the system but it was on teams and I was covering reception at the same because receptionist was off sick. No excuse but I was doing my job and reception jobs and trying to sit in a training session at the same time so I was out of the training more than I was in (management were aware) and as for managerial support today was the first time I had spoken to me my manager let alone seen her since my interview. She hasn't spoken to me since I started. The only guidance I have had is off my colleagues who have all done the job for years and years. I stupidly trusted their advice and I shouldn't have. I trusted they would know the process seems they had worked their for so long.

You haven't had ANY trust induction? Nothing at all? Information governance / basic life support / fire safety / infection control etc is all basic trust induction stuff that every NHS staff member has to do before starting their normal job. Someone has dropped the ball if you were never told this.....

Just from my Mumsnet training I know this is unacceptable and you can’t look anything up without a business need.

You should’ve booked leave and rang your replacement and asked them to look, or asked a colleague.

@taudmauvelord yes I agree, and therefore the OP might have a good defence in any disciplinary.

That aside though OP, you might want to think about leaving before they go down the disciplinary route if you are going to leave anyway. It's incredibly hard to get a job in the NHS, so if you've any disciplinary on your record about breach of confidentiality, you'll be practically unemployable. No NHS organisation is likely to take you on. This stuff follows you around and will come up on reference checks. Unless...you leave beforehand and then nothing will show.

Yes. This was a data breach. I'm very surprised you didn't know this. This is one of the most basic NHS policies. You are not allowed to access files of anyone yiu are not directly involved with. Never ever ok. I'm glad to know the alert system has worked properly.