To wonder if admin staff at a medical facility can view my medical history.

[NavyScroller]

I totally understand that patient confidentiality must be upheld, but someone I used to be friends with has just started working in an admin role in my local surgery. I have ongoing medical issues and receive excellent care from a GP there so I don’t really want to move surgeries, but there are some elements of my medical history that I really wouldn’t want this person to see and it’s really worrying me.

Would an admin person have access to this information?

Well. Your ex friend would be fired if they were caught. So no.

also you can just do an FOI for your whole record if you want

I don't know for certain. But - I'm not sure that moving to a different GP would remove their access to your records anyway? Presumably they keep them on file for a certain number of years?

Sorry if this is a silly question, but what do you mean by an FOI request? I understand that means freedom of information, but how would that help me with this?

Ohhhh… i didn’t consider that! 🤦🏻‍♀️

Key strokes are recorded in the NHS, so if you have any concern that she has accessed your records, you can have it investigated.

This won't stop her obviously, but instant dismissal is enough of a threat for most people to toe the line.

When I worked the hospital a few years back, every person who logs into medical records or blood results is tracked with their log in code. This was particularly apparent when a famous football manager was admitted to A and E and lots of staff were disciplined for logging into his record unnecessarily to have a nosy at what was going on with him. So if your ex friend accessed your records it would show up and she should be questioned/disciplined if she did so without good cause.

Do you trust this person, is there a reason you think they may try and access your notes. All staff have training in gdpr and get sacked if they access notes for no good reason. Different levels of staff have different levels of access, it might just be something you can talk to the practice manager about if you're worried! Ask what info they have access to, do they train in gdpr.

Your friend may well have access and there is nothing to stop her looking. If she gets found out - there is an audit log that shows who accessed a record - she will be sacked if she cannot provide a clinical reason for her action. Can you contact the surgery and ask them to put a flag on your record that prevents her accessing it?

That's good to know.

Admin staff at our surgery must be able to access our records now because they have a new thing where when you phone, they immediately ask for your name and date of birth and then they have your records there. Like others have said though, she’d get into trouble if she looked without a reason.

Where I work, all staff can access medical records. But you have to click that you have a valid reason to look up the notes. However, this would never be looked-into unless something was raised. So I could look into anyone’s notes and nobody would know unless there was a reason to investigate.

I think I’m just worrying because I really don’t trust this person.

@RequestSubmitted - it’s a shame there isn’t a more stringent system in place to protect people’s personal information.

i understand the doctors needing full access, and also that an admin person may be involved in current medical issues (referral letters etc), but I can’t see why they would need full access to historical information.

Disappointing they were just disciplined, rather than sacked

I agree @NeedToChangeName

My wife works in a hospital. Every time someone accesses a medical record it is logged. This is audited regularly and staff have been caught accessing medical records when they did not have a medical reason to do so. Those people were all taken to a disciplinary and some have been dismissed.

For anyone working in the NHS patient confidentiality is part of staff training from day 1 and is taken very seriously.

I think you are confused by what a Freedom Of Information request is. Perhaps you mean a subject access request, but even then. I don't think that would include who has accessed the OPs records.

I agree with other people who have said she shouldn't be accessing your records without needing to do so in order to do her job, so you should be safe as she is unlikely to want to put her job at risk.

If she has a legitimate reason to access them, she will have access. However, I would imagine, an admin does not need to access information to book an appointment. Sometimes we may request records to be forwarded to the GP (I work in a specialist service) and I ask admin to amalgamate records to do this. So this will class as a legitimate reason for them to access records.
You can certainly speak to the surgery and find out what they can put in place to prevent her seeing your records. It is not unreasonable, seeing that you have a personal relationship with her and they might be able to at least track her accessing your record if not completely prevent it. A threat of disciplinary may be enough of a deterrent.

She will have access to it but won't be allowed into your record without good reason to view it (putting documents on or booking and appointment). If you don't want her to have access contact the practice manager and have her blocked from your record.