Medical records confidentialty

[ConfidentialityNotGuaranteed]

I was to have a medication review by a pharmacist carried out recently which is fine, I have no problem with this.

But when I asked for confirmation of the time when the Pharmacist would call me, the receptionist casually informed me that she wasn't sure because he (the pharmacist) was working from home.

AIBU to be horrified that my medical records are being accessed remotely with, apparently, no safeguards to guarantee confidentiality?

It would be reasonable for you to ask them what safeguards are in place.

Presumably they are logging on remotely to the same software system they would use at work. I don’t really see the big deal. They will still be constrained by GDPR rules etc

If they're using a company issued device with endpoint encryption, access control, VPN connectivity to a corporate network etc then the confidentiality and security measures are the same as they would be in a pharmacy.

What makes you think it's less confidential?

I think your over reacting, I know lots of medical professionals that wfh and access records. A friend of mine works for the police and does dbs checks from home. This is the new way of working. You're within your right to ask how confidentiality is met but this is totally the norm in the nhs.

Why do you think there are no safeguards in place?

Not trying to be awkward but why do you think viewing at home is more risking than a pharmacist accessing at work where there will be other people about? I am not a pharmacist but I regularly access court papers at home - I have to in order to do my pre reading. I have about 600 pages to get through today for court on Monday morning. Even before electronic files we used to have the paper files delivered to the house.

I don't think it's very different. I know my SIL who is a GP works from home one day a week and has the same access to patient records as if she was in the office because otherwise she wouldn't be able to do telephone consults. My psychiatrist also uses an online secure portal to access my notes.

Who says there are no safeguards in place. They'll be using the same system with the same security.

What is your concern? That the pharmacist's spouse might peer over their shoulder? It's not likely.

That’s just your lack of understanding remote nhs systems. Don’t worry. Full protection is still in place. From home the person remotely logs onto their work server using IT enabled nhs software/hardware. Arguably more secure at home since no-one can overlook their laptop. There is no security difference in the remote access. The information is held securely on nhs server and cannot be accessed without special nhs enabled IT equipment to allow that.

I don’t understand the issue op, what difference do you think geography makes to system security?

Surely you are just mistakenly assuming that there aren’t safeguards in place.

I understand your concern. We really don't know who is listening in when the professional is working from home, we don't know if they lock their computer every time they leave it and we don't know who is in the room or who could look at the screen whilst the person is working.

My brother was horrified when he knew the level of confidential information I can access from home. Yes I use VPN and I also have a home office so I am private.

However the stuff I've read and heard where people are on the sofa, in the kitchen, living with others, juggling childcare, having friends around, popping in and out doing bits of housework. Jumping up to answer the door, let the dog out, partners working alongside them etc.

This might be the new way of working but you cannot tell me that everyone is careful.

That would annoy me too, you have no idea who is in the room with them at the time

Horrified? Nope. I'd assume it's all regulated, and wouldn't assume anyone really cares what's in my records. I mean, if I thought an ex could access my records remotely and use them against me, I might be concerned. But having an unrelated professional access them to do their job to help me is no problem.

Presumably there are safeguards though? Staff training on confidentiality, work laptop with VPN etc. I’m a GP and log on from home to catch up on paperwork, or call patients from home when I’ve had covid.

The tech side wouldn't bother me because I know secure computers and VPN exists, but the other members of the household or, if not in a detached property, having paper thin walls, would.

Assuming you’re not Kate Middleton, why would any of the pharmacists family care enough to even look at what medication you are currently ordering. Never mind know you from Adam.

@ConfidentialityNotGuaranteed why do you assume working at home = no data protection safeguards?

@Janehasamane not sure why you quoted me?

The same level of security applies, as does human carelessness. If an individual is likely to gossip/breach information, they can do it at home or at work.
In the health centre where I live 2 individuals known to me have breached confidentiality, which tells me all I need to know about the culture of that facility.

Someone could peer over his shoulder technically whether he's in the pharmacy or at home. But the system will be secure and only accessible by him. Lots of people have to WFH using highly sensitive data. They should have strict protocols in place for GDPR for those such instances. Absolutely ask them to share this policy.

Why are you assuming there are no safeguards?

We really don't know who is listening in when the professional is working from home, we don't know if they lock their computer every time they leave it and we don't know who is in the room or who could look at the screen whilst the person is working.

Open plan offices on the other hand...

I work in an area that's highly sensitive, with access to all sorts of data about people. It's for a government department.

It's more secure when I WFH as I'm alone in my spare room with no-one else around than in a shared government office where my phone conversations and Teams meetings can be heard by people who work in other organisations who have no need to know about any of it and where my screen can be seen by any passerby in the building.

WFH does not mean anything is insecure. We use government VPNs to access the data which held remotely with lots of sign in pages to see any of it. My laptop is also how I access the same things in an office, so nothing changes when I go in there except I'm using a government provided WiFi access point instead of my home one.

If you stole my laptop you'd not get into a thing.

Why would it not be guaranteed? A family member of mine works from home almost full time with very sensitive personal data (related to witnesses in court) and his whole set-up and system including internet connection is as secure as it would be in the office.