Near miss data breach - DD’s NHS appointment letter.

[user1488481370]

DD (8) was referred to a continence nurse around 7/8 months ago now as she’s still wet on a night.

Difficulty being that one of the continence nurses in the area is our next door neighbour (shes also my partner’s brother’s girlfriend) who has made our lives hell for the last couple of years. So much so they the police have been involved on numerous occasions and she’s been interviewed and cautioned. When I asked for DD to be referred, I explicitly asked that this person had nothing to do with her care.
We got a lovely nurse and DD has made great progress with her.

Said nurse always sends appointments letters, we’ve had numerous letters so far - they have always had the correct address on them.

The latest letter, however, has said neighbour’s address on. I’m so suspicious and really smell a rat. I’ve asked others opinions and they smell a rat too but I wanted the over all consensus from a bunch of anonymous people who will give it to me straight and perhaps won’t humour me and my anxious mind.

Its only because we had a new postie that the letter wasn’t delivered to their house.

I rang the appropriate department last week and asked which address they had on file for DD. They read out the correct address and even simulated a letter to see which address appeared and again, it was the correct one. Lady on the phone was very apologetic and has put a note on the system about the address.

My neighbour really, really has it in for us, without going into too much detail. I’m so paranoid that she’s somehow changed DD’s address on the system, sent the letter and then changed it back again. I just can’t understand how this letter has their address on it. Even the lady I spoke to was perplexed. I want it investigating but are these things traceable? Is it a waste of time?

I endorse what everyone says about the seriousness with which the NHS takes unauthorised access to patient records, (either unauthorised patient or unauthorised reason iyswim). DS began working for the NHS last year and it was the most strongly emphasised part of his induction,

Can you report to the NMC too? She has a code to follow! Not sure how the process works x

You need to make a formal complaint about this.

It's been a while since I worked in this area but I think this should be auditable and it should record who made any change.

www.nmc.org.uk/concerns-nurses-midwives/make-a-referral/

You can do this anonymous too! She sounds so unhinged x

@Luckymummytoone to be honest I really don’t want to name drop or report her to the NMC because living here is so unpleasant and I don’t want to do anything that would exacerbate her behaviour which is bizarre at best and down right sadistic at worst (and this likely would - she seems to act now and think later)
Having said that, I would hate to think that any of her patients suffer because of her erratic behaviour and have often wondered if I have a duty of care to report this out of work behaviour. She gives the impression of being very capable and friendly and is very proud of the fact that she’s a specialist nurse, she mentions her job to everyone she meets.

There's nothing to report her for unless/until it canbcanbe proved that she accessed the record and at that point I assume a whole process kicks in, it wont be necessary for the OP to resolve it

OP, now you've mentioned the glass I recognise that from previous threads, am I right that you've had many posts about there people?

I work in the NHS in a clinical role.

I know we all have different computer systems, but on ours, if I change anything like address, phone number etc, it will show up as a line on the record that I changed it, eg my full name, role and date and the change I made, but it won’t actually change - so I wouldn’t be able to send a printed letter.

What will happen is that when someone else logs into the record a big box will pop up about change of details, and you have to accept the change, or reject it (or click “do later”)
It would be immediately obvious to anyone else accessing the record.

I send my own appointment letters but if we don’t have any window envelopes left, I usually hand write because our printers can’t cope with envelopes.

But I would just say, in our department we do have copies of the templates of all the letters we send saved “separately to the clinical system.
I suppose it’s possible to use that way to send a fake letter, by just typing all the details out manually, and printing, completely bypassing the clinical software system.
Presumably there would still be some sort of trace on the computer if anyone did that, but they are just word documents.

I am also able to see my colleagues appointments overview on the system as well as my own (just names and addresses) without accessing the patient record itself.

Of course, sending a fake letter wouldn’t stop the original real letter being sent.

But in our department all outgoing post just waits in a tray for collection. It would be possible to remove a letter from the tray.

You aren't reporting her at the moment, you are reporting a data breach (error in your records) and it is down to the organisation to establish how that happened. (up to you whether your articulate your suspicions)

Please do report it though, as people who are prepared to break one major rule at work are often breaking others

I don't understand how the neighbour still has her job after OP showed the film to police of neighbour putting glass around OP's children’s toys and howling in middle of night to deliberately set dogs off.

I know NHS has staff shortages, but how does this person still have DBS clearance to work with small children?

And I have a friend who works in colonoscopy who told me that she'd worked with the mother of one of my favourite celebrities. Absolutely disgusting to discuss the intimate care of a woman who didn't choose fame, not that it would be OK if she had.

Just being a disciplinary matter doesn't mean that people won't do it.

There will be a digital footprint within the system. It always shows old addresses on the system so would log if its been changed. Speak to PALS they will help.

Please dont report her to the MMC. This is bad advice. You have no proof and they will inform her.

Please can people stop telling OP to involve PALS and NMC.

When I've had to track back patient info for appointment issues, admin, both gp and hospital, were able to tell me when and who notified of change of address and who adjusted the info on the system. So yes there will be an audit trail, even if she didn't do it herself, it'll show who did and when it was corrected on the system. I really hope for your peace of mind this is a simple mistake, but if not, then concerns should be raised. A note should also be placed on the system of any staff who the patient or guardian do not want to have contact with or access to information. It can be flagged up on the system at my trust if unauthorised access has been attempted.

Something similar happened to me - a member of staff accessed my records when there was no need. Just to warn you that when I found out and it was raised I was first accused of being mental (I am/was, it was so stressful) but then it was very rapidly escalated to police, social services and professional bodies plus the members of staff who hadn't listened to my complaints the first time around had to report themselves to their professional bodies.

The member of staff lost their job, had their DBS stopped and there were other repercussions but it was all a very long and stressful time.

And the OP absolutely can report in whatever way she see's fit - there will be an investigation and if this nurse hasn't done anything then nothing will happen to her.

Audit trails exist for a reason.

You aren't reporting her at the moment, you are reporting a data breach (error in your records) and it is down to the organisation to establish how that happened. (up to you whether your articulate your suspicions)

This, you are questioning why your letter has your neighbour's address on it. But also pointing out that the address on the letter is in fact your neighbour who is a member of staff who you have requested has no involvement with your child's care due to harassment from her which escalated and the police were involved.

Facts, you stick to facts. The hospital will investigate and access your child's medical records to see who has accessed them. You would be amazed how brazen some people are when they think they will not get caught. I cannot say much but someone I know investigates data breaches and says most of the time the person who realises they have access to something they shouldn't reports it immediately as they know there is a log. That person will bring up a report but it contains far more files than it should etc. There is a difference if they are in the file/account for 10 seconds and if they are in there for 2 minutes because then questions are asked.

She can, but if she wants complete confidentiality and discretion it has to be the CG.

I think you need to follow the good advice here and report.

For nothing else if it wasn't for your postman your wouldn't have received the appointment. It was just a fluke that you didn't.

That needs to be investigated to ensure it doesn't happen again.

She can, but if she wants complete confidentiality and discretion it has to be the CG.

No, it really doesn't - PALS and NMC both have confidentiality guidelines in place.

What sort of relationship do the brothers have?

If she reports to NMC, they will go to the CG and inform the employee that a complaint has been made. If she reports to PALS, they will go to the CG and the complaint will go on the PALS system and be visible to more people. I really think at this stage, when OP doesn't know who might be involved, it is better to go straight to the relevant person. I have been involved in situations like this many times and I do think it is better to not involve too many agencies/people at this stage.

Yes she must be wondering why she hasn’t received the letter yet.

I wouldn't worry it's a trap, just report the data breach with no mention of the history