To think this is confidential and that they shouldn't discuss it

[Jacketpotato65]

I'm working in an eating disorder clinic for young girls atm but I'm not part of the medical team there, I have nothing to do with that side of things. Our manager has some involvement with them though. Sometimes she'll be talking to us and she'll say, "Guess what, Sarah's lost 5lb this week isn't that awful." And stuff like that, medical information about the girls.
I've never said anything or got involved with the conversation but part of me is wondering if it's appropriate for our team to be discussing that about them, i don't think it is?

You should have policies and procedures setting out how health information should be managed, what do they say. Health information is special category data under GDPR, you have to be particularly careful with it. If as an employee there is no work purpose for you to be told medical information about a patient/client, then you shouldn't have access to it. Tbh this sounds like unprofessional casual gossiping about patients, not appropriate.

Difficult to raise if it's your manager doing this - do they have a manager you can go to? Or there should be a dedicated person/team with responsibility for data protection, depending on how this links up to the wider NHS.

It sounds like a data protection breach on the face of it, the question is whether there are policies in place that the manager is breaking, or there are no policies so it's the employer's fault. You need to raise it through HR and let them decide.

You need to take this further, who does your boss report to ?

Totally inappropriate.

Unless you are involved in that side of their care, or it is part of a wider discussion of their clinical review.

I'd note down each and every mention of it and once I had 10 seperate reports I'd send a copy of the log to the Safeguarding Lead and to HR. And I'd be happy to do it.

Inappropriate. I work in a school and wouldn't speak about any pupil like that, irrespective of their vulnerability.

Definite safeguarding breach.

Are you held to the same data protection as the medical staff?

Discussing, reviewing, manipulating personal clinical information should only be on a 'need to' basis within an organisation.

If it is relevant to the discussion (could be with finance, length of stay etc...), it would be ok. If it has nothing to do with the discussion but just from sharing of Information from a curious perspective, it is not ok.