Active discussions

Meet the Other Phone. A phone that grows with your child.

Meet the Other Phone.
A phone that grows with your child.

Buy now

Please or to access all these features

Talk
AIBU?

Share your dilemmas and get honest opinions from other Mumsnetters.

Original poster

To fear a family member is accessing our medical records

395 replies

durdledoo · 03/03/2022 08:51

I'm not really sure what to do about this and would love some practical advice to stop this potentially happening.
My mil is a nurse, she works at the local surgeries that me, my husband and my children attend. She has previously gone through my husbands medical notes before and confronted him on health complications he's had in the past and not told her about (this was a long time ago, but he was in his early twenties at the time).
A few comments recently has be concerned she's done it again. My husband had 2 drs apts and we only told her about one. She / fil has asked me several times now if dh is okay and asked about his second drs apt (that we haven't even discussed with them)
They know about one health issue and he's openly discussed it with them but the other is very private.
The other day mil said "how is dh, is he okay" and I just replied "yes, he went down and has been referred" (discussing said health issues we've told them about) and she said "well, he went down again didn't he?" Basically prying into the outcome of this second apt she should know nothing about.

I can't prove anything, but considering previous and the fact she's digging (a lot) and acting very stand off-ish I am legitimately concerned she's been at our medical notes (or at least dh's) but i wouldn't put it past her to look through all of ours. We've had lots of ongoing problems in the past with boundaries and the relationship has never been simple.

Is there anything I can do. Would loving surgery completely help? She works all over locally so I fear not.

Can we ask the surgery to make out information inaccessible to her?

Looking for some practical steps I could take to protect our privacy. There's absolutely no point raising this with her, she will inevitably deny it and previously when she went through her adult sons records he was the one "in trouble" for not telling her about his health concerns...Confused

OP posts:
LookItsMeAgain · 03/03/2022 11:30

The way I see this is you have two possible ways to deal with it.

The first is to go directly back to MiL and say that something has been troubling you and you're not sure how to deal with it. You point out that she said to you that your DH (her son) had been back to the surgery and this is what is troubling you - how did she know? You say that you're troubled because if she found out by checking his patient records, you will be left with no alternative but to report this as a data breach and she will lose her job.
The other way is to bypass the MiL and go to the practice manager and have a conversation asking that they put whatever restrictions are required on your file, your DH's file and the files of your children as you are very concerned that they are being accessed by parties not directly involved in your care.

I don't think you have any other alternative here @durdledoo. As for your comment:
I don't want her to lose her job. I also don't want to have got it all wrong; drag her through is and cause huge issues with the family. You will not be the person to cause her to lose her job. She will be that person...and I would say she knows it and knows that you don't want that to happen so perhaps having the quiet word with her first would be the way to deal with this?

Gonnagetgoing · 03/03/2022 11:31

@NoSleepNoSleep

I have a few friends who work in healthcare, we were discussing this a while ago (I cant remember why) and they were saying you can't just look people's records up, firstly they can see who has accessed the record, if they are accessing a record without professional/clinical reason eg a patient they are treating it's a sackable offence. The NHS is hot on information governance, if you flag what she's been doing I've no doubt it'd go down the disciplinary route and probably lead to her being sacked. If you don't want her to be sacked you need to have a serious conversation with her about what she's doing, if she does deny it I'd say to her well you won't mind us contacting the GPS to check if you've accessed our records?
@NoSleepNoSleep - I think in this day and age where most adults know about GDPR and data breaches this should be reported to the relevant authority but a strong conversation needs to be had with the adult responsible and you make them aware just how wrong this is.

If they then choose to ignore you and continue to access information and think they're right to do so then I'd have no qualms in reporting them, family member or not.

Sounds harsh but how would the family member in question who's snooping like it if the situation were reversed?

And OP shouldn't be having to travel miles to avoid this woman!

Elnetthairnet · 03/03/2022 11:31

Unless you speak to the practice manager you’re never going to be sure - if you just speak to MIL chances are she’ll deny all knowledge and just be more careful with what she says in future - but carry on snooping. It’s absolutely, completely wrong if she has accessed his medical record, and she WILL know this. I’d be absolutely livid if I was you.

HereIfYouNeedMe · 03/03/2022 11:39

Could you phone the surgery and ask if anyone has accessed your records? That way you're not accusing anyone but will find out if she has

Lifeismeh · 03/03/2022 11:41

I wouldn’t assume she’s accessed records. If she’s asking if he’s ok then she won’t have read that it was vasectomy.
The likely hood is she’s seen the appointment in the appointment list, and trying to dig it out of you guys.

Sweetpeasaremadeforbees · 03/03/2022 11:42

Could you phone the surgery and ask if anyone has accessed your records? That way you're not accusing anyone but will find out if she has

Yes I think I'd do this and I'd want a print out of the results. Presumably under confidentiality rules she couldn't be told you'd asked them to do this!

UniversalAunt · 03/03/2022 11:43

The MiL is a trained professional, fully aware of the law about patient confidentiality & GDPR. She is actively breaking both the law & her contract of employment.

If she is illegally accessing patient records, what else is she doing wrong? Can she not understand how wrong this is?

You are sweeping away the seriousness of the situation because you choose to minimise the impact & extent of her actions.

Tell the practice manager.

MurmuratingStarling · 03/03/2022 11:44

@Laptopsandmouses

Some of these responses are really quite odd. There is nothing to say she’s accessed his records at all. All she knows is he was at the surgery for a second appt. Confused
Of COURSE she has accessed his records. Hmm How the hell would she know he had had an appointment otherwise? As a pp said, unless she is psychic, (or someone else at the practice has told her,) how on earth could she know the OP's DH has an appointment without looking?

And if someone else HAS told her then THEY are breaking confidentiality rules too! Someone, somewhere has broken the rules.

UniversalAunt · 03/03/2022 11:44

Appointment lists are still subject to GDPR.

GreenFingersWouldBeHandy · 03/03/2022 11:46

Well, you’re going to have to rock the boat or put up with it.

Your DH needs to report this to the practice manger. Not you. Immediately.

Kennykenkencat · 03/03/2022 11:50

@Ncwinc

If she knows about the appointment but not the medical reasons for the appointment she probably hasn’t looked at his file. All it would take is a receptionist saying, ‘I saw your Eric today’ in the break room. Or even her legitimately looking to see if a GP has a no show in their surgery, because the patient she’s seeing needs to be checked by a doctor, and seeing her DS’ name on the appointment list.
Then that person should be disciplined as that is breaching confidentiality

I would report. Let the surgery find out who is breaching confidentiality

Had a problem like this before when a doctors receptionist let a family member know what pills I was taking. Caused no end of trouble. I didn’t know at the time that I could report them but if I could have got this woman fired and made her life as horrific as she had made mine it would have at least made up for a little part of it.

CallyfromBlakes7 · 03/03/2022 11:50

If you are a receptionist at a GP do you log into the system on your own name so you can be traced?

I ask because when I worked at a library many moons ago we logged into the computers with generic work log-ins, rather than our own. So anyone with access to that computer could log into an account and see the details. It's obviously not nearly as sensitive as medical information, but you could still get someone's contact details.

MurmuratingStarling · 03/03/2022 11:51

@GreenFingersWouldBeHandy

Well, you’re going to have to rock the boat or put up with it.

Your DH needs to report this to the practice manger. Not you. Immediately.

Yes, that's what I said. The DH needs to grow a backbone and call his mother out on it. Why is this shit always left to the woman/wife to sort out?!
MurmuratingStarling · 03/03/2022 11:51

@CallyfromBlakes7

If you are a receptionist at a GP do you log into the system on your own name so you can be traced?

I ask because when I worked at a library many moons ago we logged into the computers with generic work log-ins, rather than our own. So anyone with access to that computer could log into an account and see the details. It's obviously not nearly as sensitive as medical information, but you could still get someone's contact details.

Yes - you do log in under your own name at our surgery.
Calennig · 03/03/2022 11:52

She could well have known because a colleague told her but why wouldn't she have mentioned it? "Oh so and so saw dh down there again this week; I hope he's okay"?

Because it's unprofessional to gossip like this ?

My DP won't move to a more conveient GP pratcise as her childhood GP practise was full of gossips - everyone knew you'd been to GP.

I'd still write and complain to practise manager - well ask DH to as a first thougj I image it would apply to you and your children as well.

Just say you are concerned they can check to see if records have been accessed or remind staff they aren't supposed to be passing along information like this - even if it''s to tell family someone been to GP.

TirisfalPumpkin · 03/03/2022 11:53

I know it's easy to say 'report her' when it's not my boat being rocked - but in this case, it really seems like the right thing to do. If she gets the sack, reframe it - you didn't do that to her, she did it to herself by choosing to break strict ethical guidelines in her chosen profession.

If she is innocent (doesn't sound it, but there's an off chance), she will be investigated and found innocent, will keep her job. I don't think they would name the complainant, just that there has been a complaint.

If she has been looking at records without a legitimate work reason to do so, the practice need to be aware of that as they have a duty to safeguard the information of their patients. She clearly hasn't understood the ethical principles behind why she isn't allowed to treat confidential records as her own personal gossip well or ammunition to use against her family.

She might equally be picked up doing it during a random audit and lose her job anyway.

Maybe you could drop hints of some really bizarre symptoms/investigations and see if she comes back saying 'you don't have that, you'd have a referral to the specialist on file'.

in1942 · 03/03/2022 11:55

I also work in NHS HR. The systems will be electronic and so everyone's log in will be tracked so they would be able to tell by your MIL user name what has been accessed.

I doubt the surgery would be able to limit access to a specific patient. It tends to be that you would be restricted to certain levels of information so for example, if your MIL worked at only one of two GP surgery's, she may be restricted to access only the patients at her surgery but not the other. If she is able to access patient appointments as part of her role, she will likely be able to look up your DH's appointment details

The NHS have to train staff on Information Governance and also trust staff to access records legitimately but unfortunately not everyone can be trusted and if they do access things they shouldn't and it's proven, it's gross misconduct and unfortunately a dismissal

You've got options but it depends on what you want to happen.

If you contact the practice manager and said you believe your MIL is inappropriately accessing your DH's record, they will investigate. If she has accessed it inappropriately I can't see any outcome other than a sacking. If there is no evidence she has from the electronic record then they may just feed back to you and not mention it to your MIL or you could say you suspect and ask they not tell MIL in case she hasn't.

If you say you think someone is accessing it inappropriately they will investigate but it would be more difficult for them as they would be able to see everyone who has accessed it and would then have to try and sift through to see if their access was legitimate or not. They might see your MIL has accessed it and put 2 and 2 together. If they find she has accessed it without a legitimate reason again it's a dismissal

If you said you want to restrict your DH's record from your MIL but don't give a reason why there is a risk they would look into it. If they can restrict access to certain patients they may just do it but as I've said the systems aren't usually that clever so it may not be possible. If it isn't they would likely tell your DH about the policies in place to protect patient records. They might leave it at that or they might wonder why it has been raised by you or your DH and look into it, again you risk your MIL losing her job if she has done something she shouldn't

The other option is report your MIL completely anonymously with very little info other than you believe she's accessing her sons record. They will have to investigate but for all they know it could be a work colleague she's fallen out with so it lets you off the hook but she may lose her job

The only other real option is to confront your MIL and ask how she knows about your DH's second appointment. He doesn't know for sure she has accessed his record but she should be able to explain how she knows and it's up to him if he accepts the explanation. Yeah she might get upset but it's obviously a worry for you both and it's not acceptable for her to access anything if that's what she has done.

It ultimately depends whether you want her to just stop and leave it at that or whether you want her to stop and are okay with her losing her job.

Mama1980 · 03/03/2022 11:56

There isn't really any way to do this, other than report her.
Just be sure, because this is a stronger up sackable offence.

WeirdlyKind · 03/03/2022 12:01

Surely the most obvious answer is that she saw him going to his second appointment while she was at work?

Gingernaut · 03/03/2022 12:01

@CallyfromBlakes7

If you are a receptionist at a GP do you log into the system on your own name so you can be traced?

I ask because when I worked at a library many moons ago we logged into the computers with generic work log-ins, rather than our own. So anyone with access to that computer could log into an account and see the details. It's obviously not nearly as sensitive as medical information, but you could still get someone's contact details.

Yes.

Any NHS employee who has access to patient records has to log in via a chip and pin 'Smartcard' which looks like a credit card with our faces on it.

The computer keyboards have a slot which the card plugs in to.

Without this card, our logins don't work, even if we get our username and passwords correct.

The Smartcard can be traced and no one should be able to log into anyone else's account using a Smartcard which doesn't match the login details.

Either she's logged in using her own card and details, or someone was slack enough to walk away from a computer without locking the screen.

WildfirePonie · 03/03/2022 12:02

She could be checking other patients info, that she shouldn't be.

I would not hesitate to report her for the fact that she has been known to do it and sounds like she did again and also she could be checking other patients.

godmum56 · 03/03/2022 12:02

@CallyfromBlakes7

If you are a receptionist at a GP do you log into the system on your own name so you can be traced?

I ask because when I worked at a library many moons ago we logged into the computers with generic work log-ins, rather than our own. So anyone with access to that computer could log into an account and see the details. It's obviously not nearly as sensitive as medical information, but you could still get someone's contact details.

that's not allowed in the NHS, there are (or should be) NO generic work logons. You can log on as someone else but people are warned that that is an offence, also that sharing your own logon is an offence, also that any offences committed under your logon will be treated as though YOU did them.
MsSquiz · 03/03/2022 12:04

@WeirdlyKind

Surely the most obvious answer is that she saw him going to his second appointment while she was at work?
The OP has already said her MIL was not at work that week...
JustLyra · 03/03/2022 12:06

Sht when my husband was living there whilst at uni he's wake up to her say next to him with the latest vaccine he "needed" and get jabbed regardless of whether he wanted to. She just doesn't respect that he's an adult*

She took vaccinations from the health centre and jabbed him at home while he was half asleep?

There’s bigger problems than her being a bit nosy if that’s what you’re saying!

Dontbeme · 03/03/2022 12:08

whenever one of us is remotely poorly they always know and she regularly comes round with various devices, tests, stuff she's taken from the surgery so she can give us her very own check up

I think she has asked if she can borrow stuff and bring it back. The Gp's allow it

Absolutely baffled that your GP allows staff to take medical devices home for use on family, then just pop it back afterwards. Is this normal? It seems like a legal minefield as well as medically dubious.