Near miss data breach - DD’s NHS appointment letter.

[user1488481370]

DD (8) was referred to a continence nurse around 7/8 months ago now as she’s still wet on a night.

Difficulty being that one of the continence nurses in the area is our next door neighbour (shes also my partner’s brother’s girlfriend) who has made our lives hell for the last couple of years. So much so they the police have been involved on numerous occasions and she’s been interviewed and cautioned. When I asked for DD to be referred, I explicitly asked that this person had nothing to do with her care.
We got a lovely nurse and DD has made great progress with her.

Said nurse always sends appointments letters, we’ve had numerous letters so far - they have always had the correct address on them.

The latest letter, however, has said neighbour’s address on. I’m so suspicious and really smell a rat. I’ve asked others opinions and they smell a rat too but I wanted the over all consensus from a bunch of anonymous people who will give it to me straight and perhaps won’t humour me and my anxious mind.

Its only because we had a new postie that the letter wasn’t delivered to their house.

I rang the appropriate department last week and asked which address they had on file for DD. They read out the correct address and even simulated a letter to see which address appeared and again, it was the correct one. Lady on the phone was very apologetic and has put a note on the system about the address.

My neighbour really, really has it in for us, without going into too much detail. I’m so paranoid that she’s somehow changed DD’s address on the system, sent the letter and then changed it back again. I just can’t understand how this letter has their address on it. Even the lady I spoke to was perplexed. I want it investigating but are these things traceable? Is it a waste of time?

NMC investigations take years so even if she has reported the caution to them it might be that she's still in the system and able to practice as a nurse in the meantime. The NMC website tells you though if they are under any kind of impending action.

I'm erring on the side that it's deliberate. In terms of 'occams razor' in this situation foul play does actually seem to be more plausible than admin error. If it has come in an windowed envelope then the letter should have been automatically populated with the address and there shouldn't have been room for user error. The records also show that there is no data entry error that would cause it.

Someone has input that address manually onto the letter.

She sounds batshit enough to do something like this (and I've also remembered your previous threads).

I think she's in big doo doo.

not necessarily, they might have chosen the correct info from the drop down when testing the system

Yes as @gogogadgetgo says, there isn’t a drop down to select an address it’s not like online shopping 🙄
Your records already have your details on them, name, dob, address, tel no., etc…
Just like when they print out a prescription your info is already on it, they don’t have to enter it every time as it prints out from your medical records that they have in front of them on screen.
It can’t be a mistake, it has intentionally been changed.

THERE ISN'T A DROP DOWN MENU, IT'S NOT THE M&S DELIVERY SERVICE, IT'S THE NHS DATABASE!

For god's sake.....

Hi OP, I would ask not only about the address but also could they please check that it's just the relevant people who've been accessing Dds records. I wouldn't be surprised if she has been accessing all of your families records if she is as unhinged as she sounds.

This seems very logical to me,

its potentially an issue with PAF if it’s multiple government departments sending it wrong

Yep, you can tell people who have never worked with relational databases and ERPs

^ THIS ^^

Snap @VanGoghsDog same thought at the same time 😂
Its as if some people have never been to the doctors or hospital before and think the reception staff sit there typing up each patient’s personal information every time they go 🙄

Report it. I work NHS. Every time I access a patient record for my work it is recorded. It's a sackable offense to look at a record you don't need access too. NHS vvvvvvv hot on this. Report it and let them deal with it. This is a huge data breach.

Report it, even having another address on your letter is a worry, regardless of who did it/where it went. So I'd report it on that basis - it'll be clear very quickly if it was human error or this woman.

I would be very surprised if an organisation like the NHS used any form of drop down box for a patients address! We are talking about confidential medical information that needs to be kept secure at all times so I can't see how this letter could have been sent to your neighbours address unless someone changed it.
It was just pure luck that it did not reach them and it is definitely something that needs investigating considering the relationship with your neighbour.

Staff addresses wouldn't be held on the same system and/or database table as patient addresses.

Also, even if they were, what you're suggesting would only be feasible when creating the record initially, after that, the address is associated with the patient, and so there wouldn't be a need to select addresses.

I don't think OP is being paranoid.

It is a while since I worked in hospital, but in General Practice, if I accessed a patient not under my care (for example, deceased) a box would pop up asking me to state the reason for access before I would be able to see the records behind the box IYSWIM. I had to do this a few times because I managed patients with a particular condition and had to do a separate report on cause of death, even though the patient was technically "off my books". So the Practice Manager would always know if I had gone into that record and why.

They don't as a rule but a pp said they were having issues in recent weeks which meant that some addresses were being added manually.

This is the pp who said there have been technical issues with addressing letters.

OP has already said she'll report it so I guess she'll find out whether it was an honest mistake or malicious - definitely a sacking offence if intentional.

Yes but the nhs is very fragmented and different departments have different processes and different databases, and that’s just inside a single trust. While an anecdotal account the other pp meantioned may be true it’s not an indication that it’s true for the whole of the NHS

Report it as a GDPR breach regardless. Even if it's a honest mistake it should still be logged.

My ex SIL is a mental health nurse and is a cruel, mean, vindictive bully...and that's when she's on good terms with you...fucking nutcase if she turns on you, drove her 'best friend' to a nervous breakdown with her shit. You'd think she'd know better given the job she does, but no.

Sorry to derail, OP. Definitely take the advise of previous posts to complain, whether there has been deliberate access or not, it still shouldn't have happened.

@ISaidHeyWhatsGoingOn honestly, they walk among us. I’ve come into contact with some awful, awful people who have tried to make life very difficult over the last 15 years or so. It makes it hard to trust anybody and being suspicious of everyone is a daunting but necessary feeling.

Ive got an email address of the Guardian for our area (it was harder to find than I thought it would be) I thought an email would be best as I’m not great at sticking to the point and a bit of an over sharer. As you may have all realised 😬

Yes, as I said we have been having technical difficulties with our letter writing software, I think it would be really difficult to confuse two houses with different names though, when I first commented I thought maybe a member of the admin team had manually typed something like 31 rose lane instead of 32 rose lane, which is easily done (but absolutely shouldn't happen and would need reporting!) When I commented this I was just trying to offer a less sinister reason for the mistake.

Even with typing addresses manually like I described there is no drop down box or anything, we use a different software to search for the patient, their address shows up (along with their phone number, emergency contacts etc) and you type that address into the letter.

We use several different platforms to generate letters, and a couple of our methods do involve looking up the address on one system & typing it into another. So it is possible for errors to be made. We peer check all the letters before they go out though, to pick up any issues like that. However if the letter address matched the letter on the system it wouldn’t be flagged.

You’re department may but other departments are system generated letters based on User input.

Direct referrals may be manually done, but even then some departments have a way to expedite those through the printing process . Not all trusts work the same.