GDPR breach report or not?

[NCwhattodo]

I have no idea if IABU so opening up to a vote.

Friend of a friend who I see socially once a week, openly bragging about having looked at their ex’s medical notes. (Not on good terms)

Admits they know they shouldn’t have done it and it’s wrong (Said while laughing!)
They work in a hospital setting but probably wouldn’t have access to full notes. As they are admin not medically trained.
Not the first time they have admitting looking at things they shouldn’t be.

Full disclosure I think this person is an absolute twat for many reasons which may be clouding my judgement on wanting to report.

Im aware it probably means them getting fired if caught.

Yanbu yes report the twat

yabu no mind your own business.

That is awful and they absolutely should lose their job. Yes I’d report. What’s to stop them looking up your info?

Report, even if they are just bragging and showing off its still a discipline situation.

Report them they may just be bull shitting that they have looked them up.

But if they are bragging then they deserve investigating and if it's found they have then it's their fault they lose their job.

I still regret not reporting someone I worked with who told me that in a previous NHS job she'd looked at a colleague's notes. I was young and a bit naive and just thought it was shocking. But actually it was deeply unprofessional and wrong ....

She's since gone on to do far worse including stalking and harassment and been in court for it.

You are definitely not being unreasonable. They deserve to be fired, that's ridiculously unprofessional.

It’s a breach of the DPA/GDPR but also common law duty of confidence (and employment contract etc).

It could be you they look up next for a “laugh”. And they absolutely could look up more than administrative details.

report it - it’s very easy to see who’s looked at what. And then they’re usually sacked (and if a medical professional, censured or struck off by their respective professional body).

these people should be nowhere near our health data.

Yes report.

Admin staff do have full access to medical notes etc (whether she does or not, I don't know). But if she can access 'some', likely she can access all.

Report. If it's like our trust,when it was suspected that someone was viewing notes on a 3rd party for a member of their family, the IT team put a logger on the person's computer. It then caught them accessing data / info they shouldn't.

So although they were reported, they actually got themselves sacked by proving the report.

Also, you don't know who else they may ve doing this to, or sharing it with!

Absolutely report. And her judgement to brag about doing this shows a deeply flawed personality that shouldn't be able to access this data.

There is also an audit trail so, if op also supplies the name of the patient when reporting, it will be visible that she snooped.

Even if no name they can still cross reference the records accessed against patients. The name just make it easier.

Thanks, you have all pretty much confirmed what I thought. Some of you seem fairly knowledgeable on reporting. Any idea who I need to contact to do so? Also I know the name of the ex partner so can provide that information aswell.

How awful. I'd phone the hospital switchboard and ask how to make an anonymous report

I would report to the IT. Department and clinical governance, they will tell you the appropriate department if its not them

Definitely report. They should not have access to this data since they are clearly untrustworthy. They need to be removed from the job.

Is it just me that thinks this should be flagged automatically ?

If someone has access to notes they are given a password, it would only flag up if you didn't have that level of access or the patients notes were restricted in some way. At my last trust all staff members notes were restricted. Someone working in admi. Might well gave access to notes but not full medical details, this person maybe talking bollox abd has only seen basic information which is obviously private but it's still a disciplinary.

Christ that's shit.

Oh well, luckily it's nothing important, eh ?

I'm shocked you haven't reported this already.

Every time a staff member accesses a medical record, it leaves a footprint. Report her, now. She isn't safe to be in a position with this power.

It also depends on where they work, a ward clerk , reception, a &e, medical secretaries , outpatients etc. would need access to admit, discharge and locate patients. Someone working who has no need to look at notes wouldn't have access.

I'm starting to get the impression that the NHS thinks data classification is something other people do.

The person in any NHS trust who would be the one to report would be the "Caldicot Guardian". You could search for that job role in the specific trust or you could contact PALS who would be able to help you

Dreadful behaviour! He will not be the only one she's look at!

This. Find out who Caldicot guardian is and report to them. They'll have overall responsibility and will take any reports like this very seriously. It would be a sackable offence, and everyone who works for NHS knows it's a sackable offence. We're not even allowed to look at our own notes.

Family member did this regularly and then told the pub all the information. She was a Health care assistant. I tried to report her and the hospital was really difficult wanted to know exact times and dates which I obviously didn't know. She left her job 6 weeks later to become a care worker in the community. She says it's more money but I wonder if the hospital told her to jump rather than be pushed. I think it's a certain type who does this . She always wanted to be a nurse but she couldn't pass the exams. She also used to tell people she was an A&E nurse, a theatre nurse and she worked on different wards. She also tells people she's got different illnesses that she hasn't got. She's the female equivalent of those blokes who brag they've been in the SAS in the pub.