When is accessing an NHS patient record classed as wrong?

[Sp3849]

So I work for CAMHS as a secretary. My son who has autism was referred into CAMHS 18 months ago and I have heard nothing. I have rang and rang the doctors to chase and they say they have expedited it and can't do much more but I know a referral for mental health should not take this long. After asking colleagues for months to keep an eye out for his referral I was told last week after being beside myself because my son was so poorly by a colleague to check his file to see what the hold up is and if the referral had been picked up and we had missed it . Now this is a job I do on a daily basis. Parents always phone to check on referrals for progress updates for Thier children I really didn't think it would be an issue. How wrong was I! Had an email today and I am being investigated by information governance for accessing my son's health record. I have a meeting with my manager on Wednesday to discuss what I have done and I am not sure what to expect. As he was being referred to us surely I can check that referral? He would be a patient anyway. I didn't look at anything else or do anything else. It turns out when looking the silly g.p referred to the wrong service anyway and it was sent back last to year and go has done nothing with it

This was drummed in to us from day one it seemed....it is completely unacceptable and unethical to access records for anything other than clinical need and absolutely never for a friend or family member. I am a nurse.

Technically yes you did something wrong. Morally no - it’s your child and you were acting with his best interests at heart and within the remit of your role when the same situation applies to others. I think you’ve had a really hard time on here

I agree with this.

I’m also surprised at the lack of training you’ve had, on all matters, not just information governance. Most places have an induction process involving reading lots of policies on fire protocols, manual lifting, infection control etc. it seems you’ve been let down by management.

You cant access your own child's file even if it's relevant to your job. You should always get a third party to do so.

This could be for safeguarding or privacy issues, and you shouldn't be seeing it. In order to ensure this doesn't happen this applies to everyone even if there is no known issue.

For example: say blood tests identify a genetic issue or give a blood type - and a father accesses the record and realises this means he can't be the biological father - imagine the fallout.

Or there is a safeguarding concern on the file about abuse from a parent.

Or a child has disclosed information they don't want their parent to know.

You should know this. Colleagues should know this. If a colleague has told you to access the file, I would drop them right in it because either they need training or they are trying to stitch you up.

No excuses. And yes you should consider yourself lucky if you keep your job over this. (Though if your only been there two months and you've not had the relevant training on this, you might be fine but again you need to drop people in it).

Of course what you did was wrong!
Us parents have to wait patiently while our children fester on waiting lists so you should to instead of using your job to your advantage.

This is not only gross misconduct but is actually illegal and working for a healthcare trust you would have known this.

From what OP has said the training around this type of thing wasn’t up to date or adequate so it’s not all on her

Not necessarily true. If a disciplinary process has started, an employer can continue it and dismiss the employee even if the employee resigns halfway through the process. The employee will obviously leave in practical terms before the disciplinary concludes, but the employer's records will show it as a dismissal.

Not all employers bother to do this after someone has resigned, but if a case is severe (e.g. abuse of a patient in their care), they may do.

How old is your son? If he's a minor, surely this shouldn't be a problem. A parent's should be able to see their child's medical records, surely?
If he was over the age of consent, I could see this being an issue. If he's a minor it would be a ridiculous situation and state of affairs and contrary to common sense.

I could never work for the medical profession or the police. I am far too nosey and the temptation to read up on people I went to school with would see me sacked within the first day.

I don't see the problem with this. If you called, you would have been given the same information. You work in that department, you could pick up the referral when it comes in yourself. It is your son, who is autistic and under 18. I think you will okay. It's not like you looked at something outside of your working department or an adult family member or test results.

Your manager doesn't see it as a big issue. You've been insufficiently trained. You're new to the job. Don't walk away from the job. Two months in and you will be inexperienced and green. You're not going to know what you're doing or settle in for at least 6 months. Stop panicking. Relax. Grit your teeth. Get through it and chalk it up to experience.

I
But op was just looking if referral had been received, that information she would have got if called up anyway

Actually OP, in that case I think you should stand your ground.
Information Governance training is mandatory for NHS staff annually (or at least it was when I was working - I retired a couple of years ago) and for someone in a role like yours it should definitely have been part of your induction.
If it wasn't, then your Trust has far, far bigger issues than you looking at your DC's records. It seems unlikely that you are the only staff member who has slipped through the net, as for starters your colleagues don't seem to know any better. At my old Trust you wouldn't even have been given IT access without your IG certificate anc I don't consider they're particularly hot on staff training.
You did something wrong, no doubt about it. But without you having adequate training and supervision it's easier to see how it happened, especially as chasing this type of request is within the scope of your work. It doesn't make it ok, but it's significant mitigation. Of course it will be easier for your employer to get rid of you as you have been there such a short time, but they should be examining their own systems and looking into exactly how many other staff have access to confidential records without proper training. Definitely take your union rep if you have one.

You are not allowed to look up your son’s file. You should have got a member of staff to do it.

I work in the same surgery I’m at and so is my son and some of my other family. I would never look at his record or any of my family members.

If you are new I would explain you didn’t know. However, check that you were not informed of this during any training. I’m not sure if it’s covered in the mandatory training you would have needed to do.

dont give up your job @Sp3849
you know now not to do this

As it should be.

Your induction and mandatory training should have covered this. If you have non evidence of having completed your mandatory training, corporate induction or completed paperwork showing you have had a local induction the IG investigation will show this and you will be fine. If you have completed your mandatory training and corporate induction then IG is covered.

Unless it is in the course of carrying out your role it is unauthorised and a data breach.

If they haven’t given you the relevant training then you cannot automatically be expected to know the policy.

It is highly unlikely you will be disciplined under these circumstances. It is likely any investigation will flag a deficit in providing you with relevant induction training.

As a parent of a minor you will have access to your child’s GP records, and could easily have seen the referral and where it was sent on there. So I don’t understand why this is being seen as such a big deal. Obviously in principle it’s wrong, but when this specific case is looked at, you didn’t find out anything that you couldn’t have found out perfectly legitimately from GP records.

If you are otherwise happy in this job, don’t leave. I’m sure you’ll get a mild ticking off and perhaps a bit of training, which you should have already had anyway.

OP your update explains a lot, your manager was so nice and understanding because if you had little to no training and were already covering reception before completing any training then they are in the wrong and it will be them (management) who end up with repercussions for this.

In my trust you must complete hours of mandatory training and answer a quiz at the end of each one, so it's very easy to see who has and who has not completed certain aspects of training, I know others still use a paper systems but still when information governance investigate they will see you did not get the required training.

There’s been a huge amount of scaremongering and over reaction on this thread. You shouldn’t do anything hasty @Sp3849 . Give it a few weeks before you make a decision.

Integrity.
Compliance.
Ability to follow basic policy.

All these things are why it's an issue. The specifics don't matter. It's the fundamental action. It's gross misconduct in any Trust I'd imagine. OP might have mitigation if she has genuinely never received any training.

@whatausername

Integrity.
Compliance.
Ability to follow basic policy.

We know someone who trains NHS pharmacy technicians and they have a little test right at the start (the first of many). On the application form at the top is an instruction to complete the form in BLACK ink. When forms come in to apply for vacancies, any that are in another colour, or pencil, go straight in the bin. A very very important aspect of the job is an ability, a desire, a very strong tendency, a rigid habit in fact, of following written instructions exactly, even if you've done the task 1000 times before, and particularly not having a tendency to think 'this doesn't apply to me'.

Interested to know what your knowledge and experience if NHS data management is?