To report ex friend who looked at my medical files?

[LadyInRainbow]

Over a year ago a friend told me she’d looked at my medical files, because “she wanted to see what was happening” with an issue I was dealing with, I think she thought she was being helpful and it was a shared care issue that also impacted her. I was stunned at the time and asked her not to do it again. I knew she may have need to look at a certain area of my files due to her job in screening and tracking but she had no need to look at this and I told her I was unhappy at the time.

Anyway long story short this friend has now back stabbed me and made up various stories about me.

Would I be unreasonable to make sure she is blocked from viewing my files again, there’s no need for her to access them as the issue to do with her department is long past & while I brushed it off before when I thought she was was a friend her having access now makes me very uncomfortable.

I think people need to remember these people who do this are in positions of power, trusted with incredibly personal and sensitive information of patients who have a right to expect that their personal info is accessed only when needed/appropriate by people on a needs-to-know-basis.

They have the capacity to cause great harm, and to destroy a patient's sense of security and privacy, and impact their level of confidence in accessing healthcare.

You cannot be in that position of power unless you can be trusted. They have shown themselves untrustworthy.

This goes far beyond 'petty' or anything to do with interpersonal dynamics. It is not petty or vindictive to report it, it's necessary for the greater good.

Seems like a lot of people on this thread criticising OP for reporting this person don't work in these positions or understand GDPR.

Being able to access patients' private medical information is a privilege that comes with being in a trusted position. Anyone who is capable of violating that trust to be nosy or for even more nefarious purposes is not safe in this role. If they lose their job it's on them.

You weren't that bothered a year ago now you have fallen out you want to get her sacked.

You can only hope

If this is all true why wait the year? That is the thing

You didn't care a year ago - you do now - because she hurt your feelings

YABU to not have reported her a year ago

Karma doesn't work this way OP

Oh I agree honestly.

OP is BU to not have reported as soon as she became aware.

The best time to report was at that moment. Unfortunately for whatever reason it wasn't reported. The second best time is now.

I'm sorry this happened to you and you do need to report it.
She should not have accessed your notes.

Easy to spot on this thread the kind of people who should not be trusted around other people's sensitive data. It's a shame there's no obvious way of screening out people like this when recruiting for certain jobs.

My guess would be because she thought she was her friend so sadly thought like a lot of people on here ‘but I can’t report her because she’s my friend’, then the friend showed her she definitely wasn’t her friend by backstabbing and lying, and so now OPs eyes are wide open and now the friend will hopefully face the consequence of ALL of her not-a-friend actions.

That is not the OPs responsibility. Anyone with access to medical notes is told it is a sackable offence to look up someone they knows records as it's a gross breach of data protection.

Yes but OP, you only want to do this in retaliation for her back-stabbing. It's completely unrelated to her accessing your medical file which should have been dealt with as a breach of privacy, at the time it happened.

Yes, it should be reported, of course.

And there will be no need for looking for proof no matter how long ago it was. Everything is marked. I'm a nurse and day I make a spelling mistake I can change it. And even that's audited against my log in. So they will be able to see exactly when and how many times this person accessed records she had no right to.

That doesn't really matter though. The person has still commited a sackable offence. And us still employed probably doing it to other people she knows.

OP hasn’t clarified if the backstabbing is about the medical notes or not, but it makes no difference really. Her friend played with fire looking at her medical notes, and now they aren’t friends she could continue to look at them if not stopped in her tracks.

Not really because of should have reported it when it first happened not waited till they have fallen out. Had the op said I've just found out my friend has done this I'm sure many of the responses would be totally different.

Agree with other posters, this should have been reported when it happened, not now to get back at her for hurting you over something else. That's bad bad form on your part.

If reported when it happened they could have dealt with it, she is in a position of trust, having access to people's information doesn't allow you to go on a fishing expedition for information on friends and family. It should only be accessed if needed in an official capacity - anything else is a breach and you can quite rightly be sacked. By not reporting her at the time, you potentially have allowed her to abuse her position with regard her other friend's and families confidential data.

It should have been reported then and it should be now - end of!

And also op mentioned it's was shared care will also affected the op.

I started reading and thought "ah, so you didn't have enough of an issue with this to report her when you were friends, so you're just being petty now to get back at her now youve fallen out".

However, you then made a very good point: you don't want her to have further access to your records now that you know she has malicious intentions towards you. This is very valid. You have a right to protect your privacy.

So I think you should write to her senior and request that she not have access to your records, as she has shared with you previously that she has accessed them inappropriately. Those are the facts. It's up to her employer what they do about it.

And by not reporting it now OP would be allowing her to go on doing it. Why do you think it is too late? The argument is completely irrelevant to the real issue. A person with confidential system access has and may still be snooping on records.

Yes, OP can and should report it. Better late than never. Her only impetus now this is having fallen out with her 'friend'. Not a thought for GDPR and professional standards, just... back-stabbing!

You should have reported this the minute you became aware of it. You still need to report it know as she should not have done what she did rather than the fact you have fallen out.

If she has done it to you, she will have done it to others. She should not be in that job. Report it. They will do an investigation to see who elses private medical records she has accessed. Daft cow.

I'd report her. Who else data is she accessing illegally i wonder?