Near miss data breach - DD’s NHS appointment letter.

[user1488481370]

DD (8) was referred to a continence nurse around 7/8 months ago now as she’s still wet on a night.

Difficulty being that one of the continence nurses in the area is our next door neighbour (shes also my partner’s brother’s girlfriend) who has made our lives hell for the last couple of years. So much so they the police have been involved on numerous occasions and she’s been interviewed and cautioned. When I asked for DD to be referred, I explicitly asked that this person had nothing to do with her care.
We got a lovely nurse and DD has made great progress with her.

Said nurse always sends appointments letters, we’ve had numerous letters so far - they have always had the correct address on them.

The latest letter, however, has said neighbour’s address on. I’m so suspicious and really smell a rat. I’ve asked others opinions and they smell a rat too but I wanted the over all consensus from a bunch of anonymous people who will give it to me straight and perhaps won’t humour me and my anxious mind.

Its only because we had a new postie that the letter wasn’t delivered to their house.

I rang the appropriate department last week and asked which address they had on file for DD. They read out the correct address and even simulated a letter to see which address appeared and again, it was the correct one. Lady on the phone was very apologetic and has put a note on the system about the address.

My neighbour really, really has it in for us, without going into too much detail. I’m so paranoid that she’s somehow changed DD’s address on the system, sent the letter and then changed it back again. I just can’t understand how this letter has their address on it. Even the lady I spoke to was perplexed. I want it investigating but are these things traceable? Is it a waste of time?

Oh gosh. Is there someone senior at the hospital you can escalate this too?

Also definitely raise with PALS so they can investigate but also have it noted that there is a conflict of interest to be aware of.

My understanding is that anyone accessing records leaves a digital footprint. It’s a very big deal to access the records of someone you dont have clinical involvement with.

Yep, report it, YANBU

It is a data breach though. Just because it didn’t reach her.

Report it as such.

Anyone accessing the record can be identified. It is a sackable offence to access a record of someone whose care you are not involved in.

I work in an admin role, it would be impossible for a clinician in my team to send a letter secretly, for example they don’t have access to our printing service, they don’t know our postal payment code for the post boy, stuff like that.

My OH is saying it’s a trap and she’s wanting me to go all guns blazing and accuse her of doing it. Im so confused and can’t even see any obvious intention. Part of me thinks she wouldn’t be so stupid but another part of me thinks it’s the exact sort of thing she’d would do. She would’ve been furious at the time as the letter was dated just after the police visited.

A friend of mine who is a HCP was suspended for printing out a copy of a letter for her own mother, with her mother's knowledge and permission. This is potentially a really serious GDPR breach and you should definitely complain officially.

Your records being changed would be a data breach. So definitely report it, we would take it really seriously at work and audit would investigate who had accessed and changed the records

There will be a named Caldicott Guardian based at the hospital. This is the person you should contact as a matter of urgency. There is a digital footprint of everyone who has accessed a patient's record. It is a disciplinary offence to use or allow to be used another person's ID card to access an NHS computer, or to share a password. It is also a disciplinary offence to access a patient's record without a legitimate reason. Disciplinary offences can potentially be sackable offences. It is the responsibility of the Caldicott Guardian to investigate this. If you google the name of the hospital + Caldicott guardian you will be able to find the name and contact details.

You can see everyone who accessed a file on any NHS system. So unless she used someone else’s log in they’ll know. But what would she have to gain by getting one of your letters sent to her, she could just look up anything she wants to know on the system if she was willing to break the rules like that?

If this person is a registered paediatric nurse she should know better, she’s clearly senior and to have a caution on record and be as malicious as you say why have you not taken this higher? She can read your daughters notes unless you flag it higher so it flags if she does access anything to do with your child? Contact the Nmc as the behaviour is unacceptable, we should be adhering to a code of conduct and hers doesn’t sound becoming to her profession at all!!

Write to PALS at the Trust, explain you are concerned there’s a data breach and ask for investigation. You didn’t mention how you found out that the letter had incorrect address- did neighbour drop it round?

Photograph the letter and the envelope. Document the date and time and details of what happened.

Report it as high up in the hospital as you can and also to the police as it seems connected. No need to go all guns blazing. You can complain calmly, but I would be worried if not very disconcerted in your shoes.

Nip it in the bud before it escalates. Get notes put at the top of all your medical records about her as she is unhinged and who knows what she might do.

I had a similar experience. Get it dealt with.

What do you believe they would gain from receiving the letter instead of you? (I'm just trying to work out what their possible motivation for doing the thing you think they might have done would be).

but ultimately it will be very easy to check if someone changed the address and changed it back again and who's login details were used to do it.

how did the postie know it was wrong?

Don't go to the NMC or anybody else. Contact the Caldicott Guardian in confidence. This is the correct procedure.

I work in admin for the NHS and we have been having issues with our letter software for over a month- when addressing a letter or copying someone in, their address doesn't appear- so we have to use a different software to load up patient addresses, this software doesn't allow you to copy/paste so you have to manually add the address. It would be really easy to get a digit wrong in this situation.

I also don't see what she would gain out of sending the letter to herself, she could have just read it off the screen or printed herself a copy there and then, why wait for the post?

I would certainly ask the hospital to investigate because even if it was an 'innocent' mistake it still shouldn't have happened.

I also don't understand why she would send the letter to herself when she could read the contents of the letter on the screen?
And how would a new postie know the address was wrong?

I’ll try and answer everyone’s questions as well as I can:

I have no idea what she’d have to gain, my first thought was that she’d hope I wouldn’t get the letter and subsequently would miss the appointment, perhaps show that I’d missed appointments and have it add weight when she reports me to SS (which she has threatened to do in the past)

The other theory is that she’s done it to get in my head, a bit of a mind game, now that she can’t damage our property and intimidate me and my children (after the police have warned her) it’s her way of retaliating.

In all honesty I’m terrified of this woman, I’m terrified of her partner, they’re both so slippery, tricky and intimidating which is why I haven’t escalated it in the first instance although now I know I definitely need to and will. If they can’t directly intimidate, they’ll find a way.

Re the postie, we all live in a yard, all the post used to get delivered to what we refer to as the ‘top house’ which is empty and we’d all call into the top house to get said post. Said neighbour used to go mad with Royal Mail when her post was delivered up there and wanted it delivering to her house which is fair enough really so after that we decided that we’d all just have our post delivered to our respective homes. The old postman knew this but the new one didn’t realise there were other properties down the yard and he delivered all letters to the ‘top house’ which is where OH found the letter.

Thank you for your advice regarding the guardian, I’ll be starting the complaints procedure tomorrow.

Sorry, it wasn’t a single digit that was different but the actual house name.
But interesting that the software has been playing up this month.

My thoughts are that her intention was that I didn’t receive the letter at all. I’m really stumped with it all.

I'm betting from the set up you describe it's probably been a genuine human error and because you will all share the same postcode someone has clicked the wrong address for the envelope from a postcode based auto fill. I live in a similar sort of set up and we all get each other's post all the time - right name wrong address e.g one house is Emmerdale Farm, one is Emmerdale House and the other is Emmerdale cottage. The regular postie knows which way round they go but the relief postie delivers strictly to the correct address regardless of the surname (or dumps the whole lot at the 'top house')

I'm guessing there's a reason you all live so close to each other despite everything that's gone on. Farming?

People don't look for "gain" when they try to access private data, they fish about for information with little purpose. There is no requirement for "gain" to be shown for it to be a criminal offence. Its highly suspicious and the OP has later clarified that a different house was listed on the letter and not just a wrong number of house. Its far too much of a coincidence for the software glitch you describe.

OP you need to make an official complaint and if the NHS trust don't take it seriously, then complain to the police. The fact that it involves a child is particularly concerning.

@pastabest yes, exactly this and if I’m honest, I’m hoping it is just a simple human error like this!

She’d be very stupid to do this as pp said everything you access leaves a trail.

I think they have created a fear in you and I understand why from the way you’ve posted about her.

Definitely report it as a data breach though.

It's very traceable. I work in the NHS and they take data protection very seriously. They will be able to see who has accessed the record and take disciplinary action if anyone has accessed it without a valid clinical or admin need.