will I get suspended from work?

[redrose80]

NC so not identified and will change a few small details again so not to be identified.

I have been off work with anxiety for 3 months now due to bullying behaviour, all of which I can evidence in a very thick folder of emails I've printed out.

I have been getting lots of panic attacks due to the horrible behaviour and I'm not the only one who is being bullied, again which I can evidence.

I still had access to work emails, shared drive, intranet etc and used my time off to gather more evidence - email exchanges, examples of reports I had done that my manager has been taking credit for etc.

My union rep had told me to gather all the evidence I could for my grievance - which I submitted 2 months ago yet still don't have a grievance hearing date.

However, whilst gathering evidence, I totally accidently came across a large patient file on the shared drive. It has very confidential information which I won't go into obviously. It is not the NHS though.

I immediately reported it to the DP officer. The document has now been removed. This was 2 weeks ago.

Yesterday I got an email (to my personal account) asking me to meet on Monday with the area manager and an HR business partner. My union rep is coming with me.

Yesterday I discovered that my access to work emails etc has been blocked.

I am now utterly terrified of what is going to happen on Monday. Will I be suspended?

I haven't done anything wrong, I didn't go looking for that document, I was only looking for my own files. But they could turn it around on me couldn't they?

My union rep says I've done nothing wrong and they shouldn't be blocking my access but I am very scared.

I really need some hand holding and some advice from anyone who maybe works in HR, legal areas, in a union or what.

Oh and they say they've reported it to the ICO but I can't be sure that they have and there was no 72 hour patient notification that I could see either.

I've tried to keep this non identifiable so please don't out me if you recognise my story and apologies if I am vague in any follow up replies.

They’ll need to investigate what’s happened both with your grievance and with the data breach - that will involve talking to you - start writing a timeline of what happened and any questions you have.

It seems unlikely they should suspend you but they might be worried that you are using a lot of time when you are off work sick trawling the network and what else you might look for.

If you are too ill to do your job how are you well enough to be logged onto work files finding evidence for your grievance. If you don't like working there move on.

Are you allowed to work from home? I work in the NHS admin and we are not allowed to. I know the Doctors have a shared laptop that they share that allow remote acsess. If you are not working and just logging on to look around I can see why they might be unhappy about it as usually if you are off sick you wouldn't be able to do this ( but I'm guessing you work in a area that you can work from home and it's set up to allow it ) I don't know anything about the legal side of things but what kind of evidence are you talking about ? Is it just your emails ? if so I imagine your company would have a policy on using email whilst not in the office.

we couldn't get into patient files from home but if we could and did so we would be sacked as we don't have permission to do this. Are you just looking through the full system opening any documents?

One of the things they will look at is the name of the file / documents you accessed to see this patient's file. Was there any classification that would have meant you should not have opened it for example?

yes I am allowed to work from home and we also have remote access which can be used through home PCs, library computers etc which makes the data breach more serious.

My union rep says someone else reported the same breach the day after me.

Being unfit for work doesn't mean being unfit to check emails (but not respond). I want to keep updated with what is happening in work, especially if any emails are sent there regarding my grievance. Plus there are pay negotiations ongoing with the unions and I'd like to keep updated on this.

The document was not encrypted or marked confidential.

I found it as I was doing a search for a particular document and this document had one of the same words and it came up in the list of matches. It wasn't clear who owned the document and I opened it initially thinking it was perhaps something I had created that I had forgotten about.

I don't know your employer, but I do know that my employer doesn't want people accessing anything when they're not working. One of our supervisors was written up for responding to an email while she was on vacation, because we're not supposed to access our email when we're off the clock. You wouldn't be suspended for it, but they don't look kindly on it either. That might explain why access was blocked?

that explanation doesn't wash with me because no one else off sick gets their emails blocked.

And my manager has emailed me numerous times whilst on holiday. Even phoned my mobile when I ignored the emails.

Part of the bullying grievance!

Wasn't there a similar situation a few weeks ago? Someone came across some confidential files and reported it, and was then worried they would get into trouble for opening them in the first place. I don't know the outcome.

I've never worked in health but in my sector I've never heard of anyone having their access suspended while they've been on long term sick leave. It might be different if you have access to patient information though - restricting access on a need to know basis etc.

Have they not said what the meeting is about - the data breach or your grievance? They might just need to go through a process of interviewing people in relation to the breach and documenting it.

the data breach only

I am in tears. I've never been in this situation before. It's all been so horrid.

I have been awake all night.

May I advise you to be guided by your union rep. As they’ve advised, it certainly sounds as though you are on solid ground. Blocking your account seems rather heavy handed.

Check your grievance policy before the meeting, there may be useful timelines and procedures that will dictate the next steps. You can make sure you all agree to work to a pre-defined process.

I’m not clear why the presence of the file is a data risk as it’s not left the organisation but I assume you have internal need to know rules that have been breached.

I will say this. Stay calm in the meeting. Let your union rep guide you. Be as succinct and unemotive as possible, don’t actually say things like “that doesn’t wash” as it’s tipping into hostile (I know you’re just talking to us!) and use your notes.

Please try not to worry. A patients file has been saved / stored in an area it shouldn't have been and was also not properly labelled so has been accessed by someone that shouldn't have seen it. That has to be investigated and this meeting will be a fact finding one. You'll be asked how you came to access the information, where it was etc.

Unless it was clear what it was from the title of the document that you shouldn't open it, you have nothing to worry about.

Plexie - yes there was an almost identical thread a few weeks ago - I’m not sure what happened to it in the end.

Hopefully the meeting will just be an opportunity for your employer to assess how you managed to access confidential files and put steps in place to prevent it from happening again.

Sorry missed your post before I posted. Are you sure the meeting is to talk about the data breach only?

I’m assuming they are investigating the data breach, try to see it as a separate issue one of which, isn’t an issue or relevant to your grievance.

Were you spending an hour collating your back up documentation using your laptop to access documents relating to it when you came across something that you viewed as a data breach and raised your concerns through the correct reporting procedure?

Nothing wrong with that.

I’m not in the health sector but I have full access remotely when off on annual leave and if sick.

Good luck with it all.

Try not to worry. You have a Union Rep to do that for you. They have to investigate. Imagine if they didn't it would be far worse. You have to find your calm.

I hope your union rep will advocate well for you. Im assuming you think blocking you sounds like some kind of company arse covering exercise whereby you’ll be hung out to dry. This may be the case. However the company may perhaps be concerned that the colleague, who created the document has created others. Blocking remote remote access diminishes the risk of any further breaches reaching outside the office whilst investigations take place, so you may find this is company wide. Less likely perhaps but something to bear in mind.

Has your access definitely been suspended? I work with confidential information and our accounts go into a dormant phase if not used for three months and IT have to get you up and running again, this would be the case for sick leave, mat leave, secondment etc. I think it's an automated process to do there be loads of active defunct accounts of people who've left etc. Once dormant for twelve months they are deleted unless a manager puts in an extension request. Could it just be you've hit the months so your account has been frozen?

*to stop there being

Didn’t you post about this a few weeks ago?

Speak more with your union rep. Be very specific about what your concerns are, ask her these questions. They're usually honest about the potential outcome.

Are you still on long term sick? If so, I am pretty sure they can’t ask you to come into work, be that for a data breach or a grievance investigation.

Where I work it’s written into employee guidance that you can only search records for genuine business needs ie not because you fancy being nosy and seeing what’s written about so & so. It was also be normal that your access has been revoked if you’re on long term sick.
Having said that you’ve identified a DP breach and reported it to your DP officer. I don’t really see what’s wrong with that - you followed procedure right? Unless you shared it or saved it somewhere you shouldn’t I don’t see what you’ve done wrong?

I must admit, if you're off sick with anxiety due to bullying, much of which has been carried out by e-mail (hence the need to gather evidence), then spending that time trawling through those e-mails doesn't exactly sound like a good way to promote your recovery.

In this situation, your organisation might reasonably expect that you take positive action during your sick leave to improve your mental health. Focusing on the specific thing that has allegedly damaged your mental health might not be considered helpful, so they may have decided to block your email access while you're off so that you can focus on getting better.

Like it or not, they have a duty of care. You have told them that the e-mails (as part of a wider claim of bullying) are making you ill, so arguably, it would be irresponsible of them to allow you continued access until your mental health has recovered.

Of course, it's possible that they're trying to stop you from gathering evidence to support your grievance, but after three months, I think the boat has already sailed on that one.