To fear a family member is accessing our medical records

[durdledoo]

I'm not really sure what to do about this and would love some practical advice to stop this potentially happening.
My mil is a nurse, she works at the local surgeries that me, my husband and my children attend. She has previously gone through my husbands medical notes before and confronted him on health complications he's had in the past and not told her about (this was a long time ago, but he was in his early twenties at the time).
A few comments recently has be concerned she's done it again. My husband had 2 drs apts and we only told her about one. She / fil has asked me several times now if dh is okay and asked about his second drs apt (that we haven't even discussed with them)
They know about one health issue and he's openly discussed it with them but the other is very private.
The other day mil said "how is dh, is he okay" and I just replied "yes, he went down and has been referred" (discussing said health issues we've told them about) and she said "well, he went down again didn't he?" Basically prying into the outcome of this second apt she should know nothing about.

I can't prove anything, but considering previous and the fact she's digging (a lot) and acting very stand off-ish I am legitimately concerned she's been at our medical notes (or at least dh's) but i wouldn't put it past her to look through all of ours. We've had lots of ongoing problems in the past with boundaries and the relationship has never been simple.

Is there anything I can do. Would loving surgery completely help? She works all over locally so I fear not.

Can we ask the surgery to make out information inaccessible to her?

Looking for some practical steps I could take to protect our privacy. There's absolutely no point raising this with her, she will inevitably deny it and previously when she went through her adult sons records he was the one "in trouble" for not telling her about his health concerns...

@Ukholidaysaregreat

I think confront your MIL if you want to. If you go to the practice manager she will be fired and I think that would destroy your family relationships. So that would be a massive step. Think about how you would like the relationship between you and MIL to be in the future and get on the same page with your DH. Your MIL is definitely wrong to be looking at your records but do you want her to be fired and humiliated or just to stop doing it and show more respect for you both as adults.

Exactly this!

Ask the practice manager to restrict access to your records, and also ask that that request be kept confidential. Then the only way your MIL will find out is if she tries to access your records and can’t, if she kicks up a fuss you’ll know she has been looking at them.

I would also put this request, especially the part about keeping it confidential, in writing.

I’ve worked in numerous GP surgeries and this is a very odd situation, every surgery I’ve worked in has automatically restricted access to family members records unless the family member has given written consent for the person working at the surgery to have access. This should be the default - not the other way round.

@Freddofan

Remember that it’s also entirely possible one of her colleagues has said something about seeing her son / saying hello at the surgery the other day and she’s just fishing.

This....

BUT in the three nhs trusts I worked in... Actually actively accessing someone's records you had no business doing...

This is gross misconduct and a sackable offence... In fact someone at neighbouring trust was sacked immediately when it was discovered he was accessing his mother in laws records, can't recall why he said he was doing this.

The ONLY reason for a clinician accessing records is TO RECORD OR REVIEW THEIR OWN PATIENTS....

However,
I worked in a group room, as many clinicians do, and very occasionally you couldn't help overhearing information about someone you may vaguely know....

When this happened to me... It was a neighbour... I said to clinician that if she needed to speak to her again, to let me know and I'd go elsewhere for a while.

This is completely different obviously to someone accessing confidential records for their own interests.

Confidential information is taken VERY seriously in the NHS... Before I've bumped into patients at parties... You NEVER acknowledge them UNLESS THEY SAY, DEVIL & I know each other from eslewhere. And even then, I would not give ANY info implying that they were my patient and I'd move on pretty swiftly to another group!

All of someone's medical info is confidential.... Even then fact they've been referred to x, y and z is confidential... It is confidential even that you're a patient there...

All of it!!

I'm petty so if that was me I'd go for a std check up so I'd soon know if shes been looking then lol

Privacy concerns would require you all move to a pratice she is not working at with instruction to be informed if she is allowed to work/temp there.

If she fails to see that she should not be accessing her families medical history without permission she is never likely to change. If she can't keep her knowledge to herself and justifies her breach of trust and her professional standards she will have no motivation to change.

The system should have an access record of by whom and when a medical record was opened so the pratice should in theory be able to see if your MIL opened the files. You could request a search be made to check this.
In theory any file can be restricted by tagging it and not giving a user authority to access it. Under GDPR all software should have that option, but in a HC setting the 'best pratice' is really to remove the HCP as its a choice to breach trust and professional standard (Restricting access remains a problem as she can use others to access the files).

Medical staff would have access to all the files as a nurse would need to be able to check a full medical history.

She may have had a professional reason to do so eg she was doing health check list and the system flaged the second health issue ( high risk re C19 / insulin clinic ).
The justification of would be up to her employer.

However your question, if asked, would be professional misconduct issue which impact the pratice, the doctors and her professional registration. The pratice staff are not stupid and if a patient raised a potential data breach issue, the pratice manager should investigate.

You can act for your own and your childrens data.
Its your husbands file so he needs to ask for his data to be protected.
Is your DH willing support you in objecting to her probing if you tell her to mind her own business and/or to deal with her getting into trouble at work?

@EinsteinaGogo

OP

Next time she asks a question you don't think she should have knowledge of, call her out on it.

Don't mess about. It doesn't have to be aggressive....

A "how do you know about that?"
"We haven't mentioned that to you yet"
"We're keeping that to ourselves until we know more, how come you're aware of it"

All those questions are reasonable.. don't ignore it.

This

well, he went down again didn't he?"

What did you say when she said that? I would have asked her what she meant and what she was talking about.

My former best friend got a job at our GP surgery, and as it is rural, we have no other option to change to. Our friendship ended very badly and she made my life hell to such an extent that I had to involve the Police. She told my DH that I was having an affair, phoned SS reporting neglect of my DC..... It was absolutely horrific at the time.

So I rang the practice manager, and explained that under no circumstances did I ever want to be booked in with her and did not want her to be able to access my notes or those of my DH and DC. I didn't go into detail other than having privacy concerns from her living in the village/kids went to same school sort of thing. They were fine about it, and seemed very understanding.

@AllOfUsAreDead

I wouldnt give a shit about her job. She knows the rules, everyone gets told not to access certain records.

I'd go to every practice manager of every surgery she goes to and tell them what she is potentially doing and insist on a check being done.

If she has been doing it and loses her job, that's on her being a twat, not you.

Totally agree with this ^ I wouldn’t even think twice about reporting her. It’s not difficult for them to check if she’s being doing it.

You need to talk to the practice manager of the surgery you are registered with and ask for your family's notes to be sealed or for her access to be blocked. You can site your DH's embarrassment over the vasectomy appointment if you need an excuse. If she is accessing the notes she will find out the next time she tries - but still won't be able to directly say anything to you will she? It will also likely trigger a report somewhere if she tries to access something she is specifically blocked from.

@Ncwinc

If she knows about the appointment but not the medical reasons for the appointment she probably hasn’t looked at his file. All it would take is a receptionist saying, ‘I saw your Eric today’ in the break room. Or even her legitimately looking to see if a GP has a no show in their surgery, because the patient she’s seeing needs to be checked by a doctor, and seeing her DS’ name on the appointment list.

This makes sense to me. This is a super sensitive situation and one in which well meaning concern and jumping to conclusions could blow up spectacularly with serious consequences for everyone. It might be that she's accessing your records; I think its more likely that whats happened is what the poster has detailed above....if I were you I would put the issue of the access aside for the moment, as you suspect it may have happened, but dont know for sure. Rather deal with what is concrete ie her nosiness about your husbands health and the appointments hes making + the reasons therefore. Next time she starts feeling you out about this, say firmly that you appreciate her concern but that he is a grown man and is entitled to some privacy around his health and his movements. Make it lighthearted if you want, but draw the boundary. tell her if anything serious happens, of course she'll know, but point out to her that he's out of nappies now and she's starting to act a bit stalkerish.

Sorry haven't read the full thread but under the Cauldicot principles no family member is allowed to access another family member's medical records. Only the person themselves can apply to see their own medical records.
This is totally unacceptable and she could actually maybe be prosecuted. I would be informing the practice. If she doesn't realise this is completely wrong she shouldn't be working there.

[quote RedWingBoots]@KohlaParasaurus she may have "innocently" seen the screen but she should not have brought it up.

It is up to the patient - in this case her son - to mention himself to her that he had an appointment.

If he doesn't bring it up she must never mention it. That is part of the ethics of her job.[/quote]
Thanks for clarifying this. I totally agree. It's important that confidentiality should be maintained at all levels.

She gave DH a vaccinate I thought his consent just because she believed he needed it?! This woman is crazy. That is assault.

Quiet word with the Practice Manager. Say that with MIL working there and at other surgeries you are concerned that she may see your health records, and would like them protected so she cannot access them. If she asks you if you have any concerns that she has assessed them, smile vaguely and say you would be shocked and just wanted to protect your privacy. They probably know what she’s like.. nosey people are quite obvious 😂

Tell your practice. When DD1 was born we were concerned by some things my MIL (a district nurse) said/did in the lead up and whilst we were still in hospital, I spoke to a midwife about it and she was able to discreetly raise it and got it checked out. In our case it turned out that nobody had accessed records that didn't have a need to and it was coincidence/additional paranoia on my behalf, but it's worth raising. MIL doesn't know to this day about it, I would know if she had been told about it!

I used to be a nurse and my job involved looking at medical records a lot. The level of confidentiality can't be underestimated.

I wouldn't even look at my own notes to find out a test result that was needed for my department (they wanted to know if I had Flu). I went to a doctor who accessed the result for me.

I once had to review notes of a patient but realised I knew them. I went to my manager and explained the connection, and she made a decision about whether I could access the notes.

I once had to access the notes of a relative. I went to the manager and she decided whether it was appropriate for me to access the notes.

Every record we accessed had an 'audit trail' button. Clicking that button showed the date, time and user code for each access of the notes. There is no escaping the audit trail.

The only way she could have got access without it being recorded is if she read over the shoulder of a colleague, or a colleague broke confidentiality by telling her.

So in reality if she actually accesses his full record then yes, that's a breach and the systems are in place to show exactly who accessed the record, when and what for.

One thing that is tricky is on appointments screens there is usually a brief description of what the appointment is for. So she can easily see this without it being recorded that she has done so.

We have a rule that we don't take on patients or staff where they have close family members who are working for us. We are a very rural practice but the rule works well and people are understanding.

I'm an ex NHS nurse. Accessing medical notes is an instant disciplinary, if you have no right/need to do so. IT can track who has accessed notes, and when.To get into notes you have to aknowledge on the front page that it is a disciplinary if you have no business doing so. A colleague of mine was sacked for accessing her mothers notes without permission.

@durdledoo

Thanks so much everyone for responding quickly.

The first time she looked at dh's records we weren't together. It was 10+ years ago. I'm not sure if perhaps back then it was easier to get away with it?
What concerns me is that she's done it before and she seemed to think she had a right to as he's her son. He got sat down for a serious discussion with his parents because HE was in trouble for not telling them about a health concern (nothing life threatening not that it should matter). When he told me this had happened I was shocked she'd done it but more shocked she had the balls to tell him she had AND he was the one in the wrong.

She could well have known because a colleague told her but why wouldn't she have mentioned it? "Oh so and so saw dh down there again this week; I hope he's okay"?

The second apt (they shouldn't know about) is for a vasectomy the first apt is for his a minor op on his hand (which they know about). It's not a case of us ever not telling them when something serious is wrong, whenever one of us is remotely poorly they always know and she regularly comes round with various devices, tests, stuff she's taken from the surgery so she can give us her very own check up. I don't think she is worried we'd hide something serious from her, I think she's a very nosy person who sees her son as an extension of herself.

I don't want her to lose her job. I also don't want to have got it all wrong; drag her through is and cause huge issues with the family. I just want to be able to quietly put into place a way of her not being able to access our records, I wondered if this was possible?

It's been a rocky 10 years knowing this woman and the thought of rocking the boat gives me anxiety.

My goodness,@durdledoo That’s appalling!

Snooping like that is incredibly invasive.
I’d definitely say something to practice manager.

What a sticky beak your MIL is.

Completely unacceptable in a Nurse.

@durdledoo

Thanks so much everyone for responding quickly.

The first time she looked at dh's records we weren't together. It was 10+ years ago. I'm not sure if perhaps back then it was easier to get away with it?
What concerns me is that she's done it before and she seemed to think she had a right to as he's her son. He got sat down for a serious discussion with his parents because HE was in trouble for not telling them about a health concern (nothing life threatening not that it should matter). When he told me this had happened I was shocked she'd done it but more shocked she had the balls to tell him she had AND he was the one in the wrong.

She could well have known because a colleague told her but why wouldn't she have mentioned it? "Oh so and so saw dh down there again this week; I hope he's okay"?

The second apt (they shouldn't know about) is for a vasectomy the first apt is for his a minor op on his hand (which they know about). It's not a case of us ever not telling them when something serious is wrong, whenever one of us is remotely poorly they always know and she regularly comes round with various devices, tests, stuff she's taken from the surgery so she can give us her very own check up. I don't think she is worried we'd hide something serious from her, I think she's a very nosy person who sees her son as an extension of herself.

I don't want her to lose her job. I also don't want to have got it all wrong; drag her through is and cause huge issues with the family. I just want to be able to quietly put into place a way of her not being able to access our records, I wondered if this was possible?

It's been a rocky 10 years knowing this woman and the thought of rocking the boat gives me anxiety.

I can't tell you how utterly wrong and illegal this woman's behaviour is!! Poor you, you and your family DESERVE and are entitled to LEGALLY privacy.

If you go to the practice and assuming they'd check to see if she had accessed.... I would check if I was the manager... She should (will) be sacked...and reported to the ICO.

Alternatively... Preferably both you and your OH, SAY to her...

You must stop accessing our medical records NOW...

Youve admitted doing it, in the past... You are NOT entitled to do this, family or not.

IF we believe you're doing this from now on... We WILL report this to the practice and the information commissioner....

She'll know how serious this is, if she's a registered nurse.
It's the sort of thing that gets people struck off, and rightly so.

My mum wasn't nosy or a nurse for that matter , but there are lots of medical things I would not have wanted her to know and that were PRIVATE.

@hashbrownsandwich

So in reality if she actually accesses his full record then yes, that's a breach and the systems are in place to show exactly who accessed the record, when and what for.

One thing that is tricky is on appointments screens there is usually a brief description of what the appointment is for. So she can easily see this without it being recorded that she has done so.

We have a rule that we don't take on patients or staff where they have close family members who are working for us. We are a very rural practice but the rule works well and people are understanding.

It is still a confidentiality breach to approach a patient/patient's wife and ask what their appointment was for!

I wonder even if he requests a restriction on his records this may trigger an audit so will eventually flag it anyway?

Other colleagues shouldn’t be saying they’ve seen dmil’s relatives.
Someone I worked with told a colleague they’d seen her dm at a clinic.
The colleague reported them for breach of confidentiality and she got disciplined for it.
I once saw that an old colleague of my ds had a stillbirth.
My ds doesn’t know because I wouldn’t dream of telling him.

Your mil OP needs to be complained about because she doesn’t respect privacy and is breaking gdpr.

Can staff working in the NHS just confirm something:

Janet is a patient at a hospital, awaiting a diagnosis of a serious, potentially life-threatening health problem.

Julie is Janet's sister-in-law and works at the hospital.

John is one of Janet's consultants.

Julie goes to find John (benefit of the doubt she bumped into him, but I doubt that) - she asks him whether there's any news about Janet. Both women have the same surname - John knows they are related. John gives her up to date news - not necessarily the diagnosis (that hadn't been formally made yet) but whatever news he has.

That's not allowed, is it?

If she doesn't realise this is completely wrong she shouldn't be working there.

This^ It's not just about the OP's DH, she could be looking at anyone's notes. Or one of her colleagues may have accessed them for her which means there's a wider problem at the surgery. I'd be asking the surgery who had accessed my medical records but I guess that depends on whether or not your DH wants to take it further.

For those saying well she can't have accessed the notes, if she had, she wouldn't have to ask about it, how naive are you? She wants to talk (nag) about the issue but she knows she can't say, I hear you're considering having a vasectomy because that shows she's accessed the notes. She needs to get the OP and her DH to confirm it before she can then give her opinion.

I'd be so cross I wouldn't give a toss about the consequences for her. If she's accessing his notes, she's probably accessing the OP's as well.