I’ve reported my friend for an NHS confidentiality breech

[BundleOfCookies]

I have a (now ex) friend who works for the NHS who works as a clerical officer who we’ll call Karen. I’m in the early stages of pregnancy and haven’t told anyone other than my dh. Had my first midwife appointment and since this, I’ve had some congratulations texts from people within my friendship group. When I queried how they knew I was pregnant, they said they heard it from Karen. When I asked Karen about this she said she saw it on my file, and shrugged like it wasn’t a big deal. I’m really upset that she’s just looked me up on her hospitals system like this. She works where my appointments are and openly said that she’s done this and has done it to a few of us in the group so she knows what’s going on. It’s my first pregnancy and I’m so anxious and I’m so upset so many people know about it.

At the time I was so angry I instantly filed a complaint to the hospital. Information governance then contacted me to say they’d be conducting an internal audit. This was 3 weeks ago and I’ve not heard anything since. I’m still upset with Karen but I now feel so guilty I’ve done this. I don’t want her to loose her job. Karen knows I’ve done this because I’ve told her and she’s livid and none of our mutual friends are talking to me now.

Is there anyone here who works for the NHS who can explain what happens in these situations? I’m guessing everything is fine because I’ve not heart anything from information governance since but I’m so worried

I think you need some new friends to be honest! The fact she accessed stuff and openly spoke about it like it didn’t matter or that she had some kind of weird entitlement to ‘know what’s going on’ shows she really shouldn’t be in a job where you deal with personal information. I’m sorry you’ve had to deal with this. It must have been upsetting to find your friend had done this and more upsetting when your other friends also don't seem to see this significance of what she has done. You’ve done nothing wrong.

You did the right thing.

I'd be getting back on to them too to chase it up!

It's common everywhere.

I'm wondering how OP would know the answer to this, given what she's posted. Only her ex-friend knows the answers. I expect she is just a nosy cow.

She may, and she SHOULD lose her job. Confidentiality is the cornerstone of the NHS, and this is told you repeatedly when you work there. She has absolutely zero excuse. You did nothing wrong, and may have protected others from more serious confidentiality breaches.

Agree mostly.

In my Trust it would take about three months.

The fact she has looked up other friends details will mean it’s unlikely she will get a written warning. More likely dismissal. She has possibly looked up colleagues info too…

Head high. She’s totally out of order. We all know the penalty for this behaviour so she’s without excuse.

Why have you chosen to call her Karen?

If you are using that as a misogynistic slur you are very very unreasonable and I really can't feel any sympathy for you.

Internal audits can and do take time to follow. If your 'friend' has made a habit of searching other peoples files unnecessarily the auditors will find out and will follow up on every single case.
By all means contact the governance department and ask how the investigation is going, in your position I would do exactly that. Your friend can expect to lose her job over this, it is gross misconduct after all.

Congratulations on your pregnancy and I hope everything goes well for you, your OH and the baby.

Bollocks is it. Find new friends.

You aren't responsible for her bad behaviour and she would have been trained to know better.

Those dick head friends are only acting like this because its your pregnancy and they think babies and gossip are exciting. they'd be raging if it was their cancer or their own child's illness.

Fuck the lot of them and don't doubt yourself. And when you do, ask yourself this: would you do it? Why not?

The people who use Pedants’ Corner aren’t the people who need their spelling and grammar correcting, though. On the internet we are seeing the wrong spellings of some words (eg your when it should be you’re) as much or even more often than the correct ones. It won’t be only the OP who sees the correction on a post and can learn something.

The equivalent of this is - if she was working in a bank and looked up and shared your friends’ financial details or their families’ financial information. Would they be happy knowing she had done that?

oh don’t feel bad OP. Your friend is in the wrong and actually she should lose her job. I work for the nhs and it’s a privilege for us to have access to people’s very confidential information.
it is literally one of the first things you learn.
She has harmed you with what she has done. Do not downplay this.

i hope you are ok. Tell your other friends what if she had seen that they had an STI or their partner is having an affair and she shared that info? How would they feel then?

In the Trust I worked for, anyone with access to the system could view any appointments for a patient within the local NHS area. Sometimes you do need this for legitimate reasons, ie to either avoid appointment clashes, or conversely to schedule appointments on the same day if the patient had a long way to travel, had mobility issues etc.

As an aside, If I were Karen’s union rep I’d immediately demand a break in proceedings once I realised the above, and then hand over the letter if resignation I’d have insisted she write. Then she can honestly say ‘no’ when asked if she had ever been dismissed from a role for misconduct

Reference requests still ask if the applicant has been the subject of any disciplinary proceedings so her boss has a right to put that down as its factual information. It may still affect her ability to get another job and rightly so.

Don’t feel guilty if this is something she has been doing she will have at some point been caught as random audit checks are done

if someone is not on your list of those you are working with you have to give a reason why you are accessing their files with a reminder of only access files that you are authorised to

no one who works for the NHS and can access patient files is not aware and not regularly reminded of the consequences of access files you have no business to

Massive breach. It's a sackable offence to access even our own files

It's not an over-reaction at all. Would you be happy going to see a doctor if you knew the appointment wasn't really confidential? She definitely shouldn't have been in that job.

I hope she IS sacked.

It's not just about you OP. What if you had AIDs, would she have told everyone that? An abortion? A miscarriage? An STD? Cancer? Mental health issues?

I'd go back to the furious anger stage, what she did was despicable.

@BundleOfCookies you have absolutely done the right thing. Well done for having the courage to do it and sorry others are not standing by you.

If you want an update you could contact PALS - the patient advice and liaison service. They probably won't be able to disclose what happens to her due to confidentiality!

HelmholtzWatson
Not convinced any harm done

What a strange opinion, hit a nerve maybe?
The op has had her medical notes breached and gossiped about. Dreadful, now wondering how often this happens, it's a violation. She needs sacked.

You have absolutely done the right thing. She had no right whatsoever to look and then to breach GDPR to tell other people. I am sorry but she definitely needed to be reported. It's unbelievable. Your friends would maybe think differently if she had looked up medical information about them and then spread it around. I have family who have been through cancer diagnosis and treatment and they were very private about it, that was the way they coped and it would have been horrific for them if that information was 'leaked'. Incidentally I have been through pregnancies and I've had a tough time and all I've wanted to do is keep that knowledge safe and protected until I felt strong enough to share. There is nothing strange or weird about that. It is an incredibly vulnerable time and to have your medical files breached like this is a form of assault.

Seriously?

It is a proper name, you know. Some women are actually called that

Hi OP,
I believe NHS incident investigations (which is what this will be) must be outcomes and completed in 30 days. So you should have a response soon. Did you make a formal written complaint, and state it was a formal complaint?
That said, not every trust is as thorough as they should be. Do not let this lie and please chase this up. If it wasn't lodged as a formal written complaint, then please make one, because they will be compelled to investigate and respond to you.
I work in healthcare, and this type of carelessness with people's details and info is not on - next time, she could leak information that might put someone at risk - for example, a safeguarding risk. You are not responsible for protecting her from her own bad behaviour.

It depends entirely on what permissions have been attached to his smart card. The practice manager at his surgery will know.
As a peripatetic practitioner I could access the patient records at 12 surgeries but I would never have accessed the record of a patient I wasn't managing.

Just wanted to add my support for you OP. You have absolutely done the right thing. What your ex friend did is utterly inexcusable and she only has herself to blame.
Enjoy your pregnancy and you will make loads of new mum friends in the weeks and months ( and years) to come.