Near miss data breach - DD’s NHS appointment letter.

[user1488481370]

DD (8) was referred to a continence nurse around 7/8 months ago now as she’s still wet on a night.

Difficulty being that one of the continence nurses in the area is our next door neighbour (shes also my partner’s brother’s girlfriend) who has made our lives hell for the last couple of years. So much so they the police have been involved on numerous occasions and she’s been interviewed and cautioned. When I asked for DD to be referred, I explicitly asked that this person had nothing to do with her care.
We got a lovely nurse and DD has made great progress with her.

Said nurse always sends appointments letters, we’ve had numerous letters so far - they have always had the correct address on them.

The latest letter, however, has said neighbour’s address on. I’m so suspicious and really smell a rat. I’ve asked others opinions and they smell a rat too but I wanted the over all consensus from a bunch of anonymous people who will give it to me straight and perhaps won’t humour me and my anxious mind.

Its only because we had a new postie that the letter wasn’t delivered to their house.

I rang the appropriate department last week and asked which address they had on file for DD. They read out the correct address and even simulated a letter to see which address appeared and again, it was the correct one. Lady on the phone was very apologetic and has put a note on the system about the address.

My neighbour really, really has it in for us, without going into too much detail. I’m so paranoid that she’s somehow changed DD’s address on the system, sent the letter and then changed it back again. I just can’t understand how this letter has their address on it. Even the lady I spoke to was perplexed. I want it investigating but are these things traceable? Is it a waste of time?

Is it very possible that using an auto-lookup system, someone typed in postcode
BA1 1AA Bloggs Road Bloggs Village, saw "barn" and "farm" under that postcode, and didn't realise they were different properties?

No, I realise that, I thought people were sharing information about how an error like this could happen from their experience in their departments and was adding my information - although in my department I don’t think it would be possible at all for a clinician to send out a letter secretly.

Report it as a data breach, point out you have checked with hospital and it seems right now so you wonder why was it changed and then changed back.

Also worth pointing out to you that your postie is in the wrong, posties are supposed to deliver to the address even if they know it's wrong. This is because if say you were planning to leave your DH and were preparing and needed letters/paperwork then you would probably not want them sent to your address but to a different one.

@1some1 i find it quite worrying that they maybe use auto look up systems for confidential matters. I honestly just thought that her address would be linked to her name and NHS number (which are both on the letter)

Just to update, I’ve finally had an email back from the CG who has forwarded it on to their Head of Information Governance to investigate as he’s about to take annual leave.

I did explain that we’d had police involvement with the occupants of said address and I also explained that one of the occupants works for the continence service and that I was justifiably suspicious. I didn’t mention any names and I didn’t make any direct accusations.

We’ve had further confrontation with them this weekend, it involved my friend as she was leaving my house. Next door neighbour started asking why she was friends with me, said I was a compulsive liar and that you don’t want to be friends with someone who calls the cops. My friend said please don’t involve me in this but it escalated and ended up with neighbour threatening to report my friend to her place of work. All the while I was telling my friend to walk away. Then the next day my friend saw neighbours partner (BIL) in his car, he pulled over to have a go at her. This hasn’t been reported to the police as my friend is in the early stages of pregnancy and I didn’t want to cause her any unnecessary stress. I’d literally just been saying that it had been quiet for a while too.

I know discussions about confidentiality in the NHS come up quite frequently on here; if violations are discovered they are punished - maybe by sacking but also by prosecution. See here: ico.org.uk/about-the-ico/media-centre/news-and-blogs/2022/08/former-health-adviser-found-guilty-of-illegally-accessing-patient-records/

@gatehouseoffleet so it seems, really quite worrying if I’m honest!

It sounds suspicious. I hope you don't need to wait much longer for an update

I’ve had a reply. They want the name of the staff member we have concerns about. I really, really don’t know what to do. I don’t want to exacerbate this behaviour. They want her name in relation to investigating this further and they’re investigating it like they would a data breach. I’ve emailed back explaining my concerns about naming the staff member and am yet to receive a reply. What on earth do I do?!

I would give the name. It's likely that they want to corroborate their findings with the known issue

You need to give her name. I'm so sorry you're going through this.

@Glittertwins that was how I took it to be worded in the email. I was really hoping it would be something they’d be able to explain easily and that if she had done anything, it would’ve come up in their initial investigations so I wouldn’t have even had to have named her directly.

What on earth do I do?!

You name them.
Realistically what can happen? You're already being harassed so nothing will change there. This is a mess of their making not yours, stand up for yourself and your child.

email them back and say that naming the person could result in a safeguarding issue and can they please explain why they need you to do this and how they will protect you and your child in ensuring that this individual will not be able to find out who complained.

My partner thinks it’s a trap. He thinks that me naming her will give her her own harassment case against us and so far she has nothing (although I have evidence and witnesses and obviously police reports to back myself up)

Have you told them which address was put on the letter? If so, you could advise them to cross check that incorrect address with their staff members.

@endofthelinefinally thats pretty much what I emailed back.

I would wait and see what their response is to that. I am so sorry, this must be terribly stressful for you.

@endofthelinefinally yes, I’ve told them which was the wrong address and sent a scanned copy of the letter also. I was hoping that she’d have come savvy and done that herself but then wasn’t sure whether she’d be able to.

I hope you can get this resolved without further stress and worry.

Thank you all. You help has been much appreciated. Hopefully we get to the bottom of it.

If that is the case she’d be an idiot. Given digital footprints (that everyone in the NHS should be aware of) she would have to prove she had a good, professional reason to be even looking at your daughters records never mind actually amending details. If her name hasn’t popped up as part of the NHS investigation then it’s a non-starter anyway.

I’d name her. There’s literally nothing you’ve done wrong here and if she has been snooping through your daughters records she’s been an idiot about it and that’s completely on her. There’s no malice in asking the NHS to investigate why incorrect details have been stored about your daughter.

Fwiw I’d also be asking for the trust to investigate whether my or anyone else in my families records had been accessed specifically by her.

You need to mention the caution too. Say you’re worried about repercussions because of previous police/caution issues or something. I agree that they and the NMC don’t know about that.

I’d also think about moving. This stress isn’t worth it to you, your family or friends. Why are you both living there? Inheritance issues?

I would name if asked again, mention the caution, and get ahead of anything she might do by potentially having a harassment case by speaking to a lawyer and having a restraining order petition go in (wait until outcome of investigation as if it is proven you should have a slam dunk case)

I would name her. They will easily be able to see what she has accessed and as she's part of the team.need to know that she is not involved in DD care. All HCP are well trained in info governance. We all know theat systems track our access to patients records and accessing pt records woth out good reason is a stackable offence . Good practice also says we should treat friends or family unless we have no alternative.