To report ex friend who looked at my medical files?

[LadyInRainbow]

Over a year ago a friend told me she’d looked at my medical files, because “she wanted to see what was happening” with an issue I was dealing with, I think she thought she was being helpful and it was a shared care issue that also impacted her. I was stunned at the time and asked her not to do it again. I knew she may have need to look at a certain area of my files due to her job in screening and tracking but she had no need to look at this and I told her I was unhappy at the time.

Anyway long story short this friend has now back stabbed me and made up various stories about me.

Would I be unreasonable to make sure she is blocked from viewing my files again, there’s no need for her to access them as the issue to do with her department is long past & while I brushed it off before when I thought she was was a friend her having access now makes me very uncomfortable.

If you'd of done it at the time it wouid of been for the right reasons at this point 👉 you are just looking for revenge but no remember this person will had a huge amount of animosity towards you if sacked.

This. Everyone's acting like you're out for revenge but actually she shouldn't have done it in the first place and no one would want someone having access to that information if that person is being malicious.
I'm in a role with access to plenty of people's private information. It is made very very clear that we can't be accessing records for our own interest so she can't claim she doesn't know that.
Please do report her. Any consequences are hers to face for breaking the rules and not on you.

Looking up your notes without permission was way out of order. But you should have complained there and then.

When DH was at the start of his career, someone working at the hospital looked up his notes, and reported a health issue to prospective employers (one of them married to the one who looked notes up). It had rather unpleasant consequences and I always regret that we didn't make an official complaint.

Apologies if I’ve missed it, but I can’t see where it says that OP wants to report the breach, just that she wants to ensure the person can’t access her files anymore.

@TimeGoesBySoSlowlyForThoseWhoWait this was 10 years ago now and she's since passed away.

If she accessed your information without a valid reason then she was 100% in the wrong and she will have had training that means she can't possibly not have known this.

If you report her, her employers should investigate and can see when/ what she accessed and investigate to see if she had a valid reason to do so. If she's found to have breached acceptable use/ access she will face disciplinary action, may well lose her job or professional registration and find it difficult to find employment in a similar field again.

Reporting her at the time because she abused her position would have been justifiable... maliciously reporting her now because you've since fallen out, and potentially wrecking her life as a result... I wouldn't want to be friends with with someone who'd do that and I'd think you were both as bad as each other.

Putting your situation aside, this is a gross breach of conduct. She could be looking up anyone. Report it.

Maybe she does, or maybe its just what she said and I can see her point, Id feel really uncomfortable in this situation too.

Would I be unreasonable to make sure she is blocked from viewing my files again, there’s no need for her to access them as the issue to do with her department is long past & while I brushed it off before when I thought she was was a friend her having access now makes me very uncomfortable.

This.

It is not the data breach that has motivated you, it’s a spiteful act of revenge for reasons that are entirely divorced from the data breach.

I would absolutely report. I work in the nhs and this behaviour is not okay!

If people were making up stories about me and using my medical information I'd want them sacked amongst other things.....

It’s your data and your right to choose what happens to it.

My friend started working at my doctors as a receptionist. One night when out as a group having a few drinks, she said 'she could look at anyone's medical files anytime she wanted'. I was really anxious over that (even though I know it isn't allowed, she technically could do it) so I changed doctors practices.

No as I said in the post she works in screening and tracking basically tracking how long it take for people to get through the cancer screening process. This is completely unrelated to the data she told me she’d looked at.

Because at that point I thought she was a friend who had made stupid mistake

I had to do an investigation into someone in work who looked at a family member's medical records without there being a need to do so. As others have said, it's a breach of GDPR. This person was given a final warning.

Your (ex?) friend shouldn't have looked in the first place without a need to do so and, if you're worried that they might look again, you can report them. Though it might be a bit late to gather the evidence. There's usually tracking on records to see who has accessed them but it's unlikely to go back 12 months. I can't believe this person actually told you they'd done it. It's a serious breach of GDPR.

It is gross misconduct. As others have explained if you work for the NHS it is drilled into you not to access anything unless you really need to, I have databases at work that give me access to information to info, so I just don't access unless I absolutely need to. Gross misconduct, particularly if she has discussed anything your records contained/

For those saying I should have reported her then, at that point I thought I could trust her, I thought she was a friend who had, had a lapse in judgement. I now do not trust her in the slightest & want to ensure she has no further access to my data even if it is for her job role.

Don't be a grass. Nobody likes a grass.

🙄
Bet you wouldn’t say that if it was your data that was breached.

Absolutely report her

There is no excuse if she looked at yours she will have looked at others that she has absolutely no business to look at and she will know this

We do not want people like this working in healthcare

I voted YABU.

This should have been dealt with appropriately at the time, not a year later out of revenge.

Report her.
The hospital will investigate.
If it was within what was permitted then nothing will happen.
If she broke the rules she will face the consequences.

Report it today because you can guarantee she will do it to someone else (and probably has done if she openly admitted it to you).

Just an example of how seriously its taken - I needed my NHS number during Covid and my Manager had to look at my records just to get it for me. You can’t even look at your own.

Report it today and you’ll be helping someone else not have their confidentiality completely breached.

Sly and petty perhaps but very useful! I am delighted to hear that someone who would do this, and therefore shouldn’t be within a country mile of sensitive healthcare records, is hopefully going to be exposed and sacked. I honestly don’t really care about the motive - though sounds like the phrase ‘live by the sword, die by the sword’ is appropriate.

Please report OP