To fear a family member is accessing our medical records

[durdledoo]

I'm not really sure what to do about this and would love some practical advice to stop this potentially happening.
My mil is a nurse, she works at the local surgeries that me, my husband and my children attend. She has previously gone through my husbands medical notes before and confronted him on health complications he's had in the past and not told her about (this was a long time ago, but he was in his early twenties at the time).
A few comments recently has be concerned she's done it again. My husband had 2 drs apts and we only told her about one. She / fil has asked me several times now if dh is okay and asked about his second drs apt (that we haven't even discussed with them)
They know about one health issue and he's openly discussed it with them but the other is very private.
The other day mil said "how is dh, is he okay" and I just replied "yes, he went down and has been referred" (discussing said health issues we've told them about) and she said "well, he went down again didn't he?" Basically prying into the outcome of this second apt she should know nothing about.

I can't prove anything, but considering previous and the fact she's digging (a lot) and acting very stand off-ish I am legitimately concerned she's been at our medical notes (or at least dh's) but i wouldn't put it past her to look through all of ours. We've had lots of ongoing problems in the past with boundaries and the relationship has never been simple.

Is there anything I can do. Would loving surgery completely help? She works all over locally so I fear not.

Can we ask the surgery to make out information inaccessible to her?

Looking for some practical steps I could take to protect our privacy. There's absolutely no point raising this with her, she will inevitably deny it and previously when she went through her adult sons records he was the one "in trouble" for not telling her about his health concerns...

I’m a community nurse, we use the same software system as our local GP surgeries. We can see most information documented by the surgeries but not all, it depends entirely on how they use the sharing settings. Every time we log into a patient’s records to either make entries or to access information there is a time, date, location and name stamp left on the records. We are not allowed to look at any records that we are not involved in the care of. We are not allowed to care for family members without certain consents and policies (it falls under a carers policy so I could look after a relative but not as a nurse if that makes sense).

Your DH would have to make the complaint about his own records, I think. It is a GDPR breach and would be taken very seriously.

@durdledoo

Thanks so much everyone for responding quickly.

The first time she looked at dh's records we weren't together. It was 10+ years ago. I'm not sure if perhaps back then it was easier to get away with it?
What concerns me is that she's done it before and she seemed to think she had a right to as he's her son. He got sat down for a serious discussion with his parents because HE was in trouble for not telling them about a health concern (nothing life threatening not that it should matter). When he told me this had happened I was shocked she'd done it but more shocked she had the balls to tell him she had AND he was the one in the wrong.

She could well have known because a colleague told her but why wouldn't she have mentioned it? "Oh so and so saw dh down there again this week; I hope he's okay"?

The second apt (they shouldn't know about) is for a vasectomy the first apt is for his a minor op on his hand (which they know about). It's not a case of us ever not telling them when something serious is wrong, whenever one of us is remotely poorly they always know and she regularly comes round with various devices, tests, stuff she's taken from the surgery so she can give us her very own check up. I don't think she is worried we'd hide something serious from her, I think she's a very nosy person who sees her son as an extension of herself.

I don't want her to lose her job. I also don't want to have got it all wrong; drag her through is and cause huge issues with the family. I just want to be able to quietly put into place a way of her not being able to access our records, I wondered if this was possible?

It's been a rocky 10 years knowing this woman and the thought of rocking the boat gives me anxiety.

I know a bit about this, I was involved in it before I retired. it was much much easier when records were on paper or file cards because no records were kept over who had accessed what. Can I suggest that you go to the practice manager but in a more general way? Wrong has been done, there is no doubt of that but if they focus on just what your Mil has accessed they may miss the actual source of the data leak. Its possible for instance that someone legitimately accessing his record told her and of course this is wrong too. Your Mil should NOT be taking stuff from the surgery or doing her own checkups and if she is, then that is also well against the rules and a sackable offence....you might want to phrase that bit as "keeping her safe" "we know its done from love but we couldn't forgive ourselves if you got into trouble" but personally I would give the batshit woman both barrels and hang the consequences.....anyway back to the data issue....Could you go to the practice manager and say that "because of things people have said to you" you suspect that there has been a confidentiality breach of your husbands records and could they investigate this please? If they push you for detail, you may need to mention your MIl in the context of you know she works there but you aren't sure how she got the information (although you bloody are). You might suggest in a general way and fopr the protection of your Mil of course, that she is denied access to your records and those of your family. This should be done anyway by default. Some 30 years ago the father of a colleague was in our rehab hospital when wards were nightingale and all records were paper. The rule then was that she could not be involved in her father's care or access his medical notes and she had to have a formal interview and agree to this before he was admitted from acute care.

I would absolutely report this. You don't need to make any direct accusation. You could just say you are concerned someone has breached confidentiality and ask them to check whether anyone has accessed the medical records. Moving surgery might not help, because she might still be able to access them. I know when I've been to hospital they can bring up my GP records.

Not only is she committing a sackable offence. She's also committing a criminal offence.

Confidential discussion with the practice manager, making it clear that you will report her to the NMC and the practice to the Information Commissioner if they don’t address the issue.

Some of these responses are really quite odd. There is nothing to say she’s accessed his records at all. All she knows is he was at the surgery for a second appt.

Some of these responses are really quite odd. There is nothing to say she’s accessed his records at all. All she knows is he was at the surgery for a second appt.

But the OP says that her MIL has admitted to doing it before despite knowing that it is not allowed so there is a reasonable probability that she has done it again.

@Laptopsandmouses

Some of these responses are really quite odd. There is nothing to say she’s accessed his records at all. All she knows is he was at the surgery for a second appt.

If she isn't accessing his records, she has nothing to fear from an audit being done then does she? I'd do the audit to be sure, and have the records made unaccessible by her for future security.

Raise the concern with the surgery. As others say, an audit can be done - if she hasn't been accessing then she may be none the wiser you have raised it. If she has then she will be reprimanded in whatever way is appropriate, and quite rightly.
If she's looking at his she'll be looking at yours at the kids too and none of it is OK. If your DH won't ask about his then raise concern about yours and the kids at least.
Either way ask for the records to be locked to her. If she gets in a strop then you know she has tried to look and found she can't.

Don't put up with it, if she's sacked it's not your fault.

I had a similar situation with my DM, many years ago - she worked at a high-street bank, but at our local branch (back when they had branches everywhere - I know, that long ago!) so when I wanted to apply for a small loan, instead of going to her at the local branch, I went into the city a bit of a drive away and took my documents and applied for the loan. It was granted and all sorted, money transferred to me and all was good, (and as an adult, I didn't want/need to have a conversation to justify myself to her as to why I wanted it and for what purpose!)
Unbeknown to me, because my local branch was where my bank account had been opened originally, that was where all the loan paperwork should be sent for filing - so it arrived in the internal mail, straight to my DM!
She came home and she went absolutely apeshit at me, we had a massive row, I was given an absolute and thorough dressing-down about this and told to repay it, told I wasn't allowed the loan, told I was deceitful, told it was unacceptable etc. etc. As I was a young adult and still living at home at that point, I just had to do as I was told - but it still gives me the rage, even now, when I think about the breach of confidentiality and data privacy. She would presumably have been sacked if I'd complained, but how does anyone, in all good conscience, get their DM sacked from the job they have done since being 18, when in her eyes she was trying to protect me from 'getting into debt' and you live in the same house. Very awkward indeed!

I think since she’s digging for information it’s more than likely someone mentioned to her (which is also very wrong) he had an appointment or she somehow saw his name on the appointment calendar. If she really is checking his medical records then she knows full well that not only can she get sacked for that she can struck off and taken to court, it’s incredibly serious.

You have two options to stop this, either you tell her directly that if it continues you will ask for your records to be made private (which would panic her as she knows they might ask why and could look the audit trail and see she’s been accessing them) or you complain to the surgery.

Just be aware if you complain this is one of the most serious offences to be accused of as a HCP and if she is found guilty she will lose her job, career and may even get a criminal record.

Laptopsandmouses she was off on holiday all that week, so should not even have known that!
She went looking, because she knew he'd been in once.
Either that or she's psychic.

At my hospital a patient can request a lift of people that have accessed their records and then make an inquiry on why a certain person has accessed them.

I was shocked she'd done it but more shocked she had the balls to tell him she had AND he was the one in the wrong

Think about what that attitude reveals - it's true you can't prove she's accessed his information again, but is there really any doubt with a mindset like this?

Despite the very few cases which are made a lot of, I'm afraid I don't believe the automatic "She'll be sacked" - not with the shortage of nurses and the tendency of the NHS to close ranks
She'll know this too, but certainly she'd be "spoken to" and that's why, on balance, I'd tell her you'll be reporting if a face to face discussion doesn't bring an appropriate response

@Alandinasane

If you report this to the practice manager she will be sacked. It's possible to track who has accessed which records on the database and this would be taken very seriously. So you could either tell her that the slightest hint of this again and you will make the formal complaint. Or you can just make the formal complaint and potentially she will lose the job. She's not fit to be in that post in my opinion, if she's done this then you can expect she's been looking up others as well.

This.

They CAN trace who has been accessing records. There was a news article about it last month saying what a common problem it was and how there had been an enormous number of dismissals as a result.

This wouldn't be happening if there was no evidence - most cases will be similar to yours.

You need to tell her bluntly that she butts out or you will raise a formal complaint and its gross misconduct. Its not acceptable.

If you aren't prepared to do that, more fool you.

@Soontobe60

Now that everything is electronic, she would have to log in to someone’s records in order to access them. This will be recorded somewhere, showing who accessed the records and when. If you are concerned, speak to the practice manager at your surgery. They will be able to check on the patient record system. If she has done this, she may well lose her job. Are you happy for this to happen? If not, I’d be tempted to jokingly say something along the lines of “wow, you seem to know more about DHs doctor visits than we’ve told you, it’s almost like you’re checking his records, but I know you wouldn’t do that would you?” Or perhaps “a friend of mine thinks her sister who’s a Health Visitor at her doctors has been looking at her records. She’s going to report it to her GP. Could the HV be sacked for doing this?”

I would be tempted to do this. Either one of the two things this poster suggested, OR as a few posters have said, tell her if you discover she has been snooping in your family's medical records again, you will officially report her.

Someone I used to know (and was trying to avoid as she becoming toxic,) kept asking me for my landline phone number. (She had my mobile one but not the home number, and no way was giving it to her.) She hounded me enough on my mobile, but at least I could switch that off! (Or see her call coming in and decline it.) I just kept telling her that it was out of order and we are having issues with it (calls not coming through, and cutting off halfway etc.)

After a few months, she called me at home on my landline. I was perplexed as to how she had got my home number. When I said 'how did you get my number' she said 'Alexandra gave it to me. She got it from the records at the surgery!' Alexandra was a receptionist the the GP Practice, who went to the same Art and Drawing group we all went to.

I was fuming, and immediately made a formal complaint to the GP Practice. I phoned up and said I had an official and the woman I spoke to gave me the email address to contact. I also copied in the head doctor at the practice and the practice manager.

Alexandra got an official warning. I didn't care what she would think or how she would act. I was FUMING. She phoned me and said she was so sorry, and as we were all friends at this group, she thought it would be OK. She said this other (toxic) woman had said she needed it, and I had said it was OK for her to give it out if she ever lost it! So she logged onto my medical record to get it!

I am sure Alexandra meant no harm, and was very remorseful, and I did feel a bit sorry for her afterwards. But she MUST have known it was unacceptable to give out a patient's phone number.

3 years later, Alexandra is still there, so it didn't affect her job/career! I would not have wanted her to lose her job, but she had to be warned and told this must never happen again.

Bit hard when it's your mother-in-law though. I don't envy you.

Not read the full thread, so sorry if this has been said .. Really @durdledoo this is your HUSBAND'S mother, and therefore, HIS responsibility to tell her to STOP, or he will report her himself.

I’m pretty sure every time a medical record is looked at, it leaves a stamp.
So if you are wrong op she wouldn’t get in trouble as it would be obvious if she has looked at them or not.

I think you need an ultimatum- she should know better. Child or not, it is none of her business.

‘ At my hospital a patient can request a lift of people that have accessed their records and then make an inquiry on why a certain person has accessed them.’

Totally do this too.

I have a few friends who work in healthcare, we were discussing this a while ago (I cant remember why) and they were saying you can't just look people's records up, firstly they can see who has accessed the record, if they are accessing a record without professional/clinical reason eg a patient they are treating it's a sackable offence. The NHS is hot on information governance, if you flag what she's been doing I've no doubt it'd go down the disciplinary route and probably lead to her being sacked. If you don't want her to be sacked you need to have a serious conversation with her about what she's doing, if she does deny it I'd say to her well you won't mind us contacting the GPS to check if you've accessed our records?

Call the roactice manager as they can check whose been looking at records. Not only coild she be sacked but could also be struck off!

Did you ask her how she knows?

I had an official complaint I shoulda said!

If she asked how his 2nd appointment went (which she shouldn’t know about) did you say “How do you know about that?”
And watch her response very carefully?
That’s what I would have done.
Then if she can’t give you an answer, you have a legitimate way of bringing up the records snooping.

@Staryflight445

‘ At my hospital a patient can request a lift of people that have accessed their records and then make an inquiry on why a certain person has accessed them.’

Totally do this too.

Yes this. Ask the GP Practice who has been accessing your records.

You need to go with your DH though @durdledoo as the GP practice won't tell you anything about him. HE will need to ask about his own. Well I would hope that they would refuse you. Maybe they won't!!! Your MIL has been merrily mooching through your DH's records, so it doesn't look like security is paramount there!

It sounds like she knows about the second appointment, but doesn't know what it's about. I would guess she has not accessed his medical records because now they are digital she'll know that she can't do this without being detected. As others have said it's possible to audit who has accessed digital records and if she's caught out it would be a sacking offence. She's more likely to have found out by looking at the appointments system or through a colleague mentioning they'd seen her son. I think your DH needs to have a chat to her about privacy and boundaries and how he will let her know if he is unwell but some things are just none of her business!