I’ve reported my friend for an NHS confidentiality breech

[BundleOfCookies]

I have a (now ex) friend who works for the NHS who works as a clerical officer who we’ll call Karen. I’m in the early stages of pregnancy and haven’t told anyone other than my dh. Had my first midwife appointment and since this, I’ve had some congratulations texts from people within my friendship group. When I queried how they knew I was pregnant, they said they heard it from Karen. When I asked Karen about this she said she saw it on my file, and shrugged like it wasn’t a big deal. I’m really upset that she’s just looked me up on her hospitals system like this. She works where my appointments are and openly said that she’s done this and has done it to a few of us in the group so she knows what’s going on. It’s my first pregnancy and I’m so anxious and I’m so upset so many people know about it.

At the time I was so angry I instantly filed a complaint to the hospital. Information governance then contacted me to say they’d be conducting an internal audit. This was 3 weeks ago and I’ve not heard anything since. I’m still upset with Karen but I now feel so guilty I’ve done this. I don’t want her to loose her job. Karen knows I’ve done this because I’ve told her and she’s livid and none of our mutual friends are talking to me now.

Is there anyone here who works for the NHS who can explain what happens in these situations? I’m guessing everything is fine because I’ve not heart anything from information governance since but I’m so worried

You were right to report her.

Anyone that backs her is just as bad.

She would have been made well aware in her job that she must not look up friends and family otherwise she boils lose her job so she is completely responsible for facing the consequences of her actions if she is sacked.

You're going to be busy with a baby so concentrate on that and not these nasty gossipy women.

She wsd wrong. It worth calling pals at the hospital. They can look in to the complaint and how it's being dealt with.

Your friends are idiots, Op.

She invaded your medical file and told people your medical information. She shouldn't be anywhere near patient information and she deserves to lose her job. She knows it isn't acceptable. Anyone that works with data like this does.

Congratulations on your pregnancy. Don't let this overshadow it!

She'll lose her job if she did it

My friend's MIL was sacked for accessing records she had no reason to access, including my friend's pregnancy records. They had suspected she was doing this, but had no proof until it was picked up during an audit. After being sacked the MIL was complaining that these were people who would have told her about their condition anyway... funnily enough this was not accepted by HR.

Please don’t feel guilty. She has massively breached GDPR and this is unacceptable.

I work for the NHS (clerical), and it is drilled into us to not access patient records without needing to for work purposes. The system I use at my Trust, when we access a patient’s record/notes a pop-up box comes up and we need to type in a reason why we are accessing these. For example, “I am dealing with a complaint and need to access the records for a particular appointment” etc.

If she does this to a lot of her “friends” just for a nosey then it should, hopefully, already be flagged up on the system she is using. Her actions will leave a digital trail.

So please do not worry if she gets sacked. As it will be her fault. Not yours.

Best wishes for the rest of your pregnancy. You’re so much better off without friends like this woman 💐

Former Midwifery Assistant here. At my Trust, your colleague would be invited to attend a meeting at which her line manager and a HR advisor would be present. The allegation would then be placed to her, and she would be given a chance to explain/justify her actions. Assuming she couldn't, she would be informed of an impending investigation, and suspended with immediate effect whilst the investigation took place. The process would also be formally detailed in a written letter. Following its conclusion, she would be formally invited to a second meeting (with a Union Rep present, if requested), and made aware of the allegations, and given a further chance to explain her actions. If evidence from her IT history suggested there was a case of gross misconduct to answer, she would likely be dismissed with immediate effect.

The same happened to a former colleague of mine, who was found to have accessed maternity records of several friends and relatives.

I would have reported my friend too, that’s disgusting behaviour and I can’t believe people have fallen out with you over it. I’ve worked in education for many years and have often had people ask me questions about children, there is no way I’d ever tell anyone anything. You have nothing to feel guilty about OP.

No. The consequences are on Karen, not you.
Tell your friends you are NOT OK with Karen accessing your personal health records and a friend doesn't do that. Then tell them to reconsider their values since they are defending it and block them all. FFS. Don't be gas-lighted. You were right to report her and are well rid of her. Do not feel bad. Be pissed off and disgusted.

Well done for reporting it, your ex friend 100% deserves to lose her job over this and you shouldn’t feel guilty at all.

It's a very serious offence and it gets drummed into us not to use our NHS log ins to look up anyone's file we do not have permission or clinical need to view. I would have reported her too, she knows the rules and was very open about breaking them. If she loses her job that's on her, not you.

I work for the NHS we do mandatory Information governance training every year. This is a massive breech of confidentiality.
The IT dept can see all the notes that she has accessed. She had no reason to access your notes.
This is most definitely a sackable offence.
I worked alongside someone who did this she was quite rightly sacked.

The obvious point is that Karen has proved to her managers that she is completely unsuitable for any job which requires confidentiality of sensitive information. She has to be sacked otherwise she will do it again.

Has she apologised to you?

Well done OP for reporting this person. What she did was very wrong and a total breach of trust.
Would your friends be so enraged at you if she had accessed their records and spread intimate and perhaps tragic information, The only person at fault here is Karen and she fully deserves to lose her job.

Your mutual friends need to think about the fact that she is clearly comfortable not only snooping in all of your medical files, but also sharing the information she finds with anyone who sits still long enough to hear her. They can have no expectation of privacy or confidentiality at all for as long as she retains that job.

She has broken company policy by looking at the records and she's broken the law by then divulging it, and it is a law, and it is her not the NHS that is culpable.

One of the changes that GDPR bought in was that the company (data controller) has ultimate responsibility to protect data, but also that under certain specific circumstances, an individual within a company or organisation can be fined for breaching data privacy law.

One of those is unlawfully obtaining personal data without permission from the data controller.

Given that every staff member in the NhS is repeatedly trained on not accessing records unless you have a valid reason to, and maintaining confidentiality of any records seen, there is a valid argument that she as an individual has broken GDPR and should be subject to action by ICO. It would be very rare for them to actually do it, but she really has fucked up.

She should lose her job. You can't just go gawping at your mates' records! And even worse sharing the information! That breaks pretty much information governance rule the NHS has.

She brought it on herself. But your friendship with her, and those close to her is probably over.

This

She will be interviewed and reprimanded, she could be fired. Someone i knew spoke about a patient by name at a departmental dinner and was sacked. She just blurted something out. However your friend may get away with it if it's a one off and she will certainly not do it again, lesson learned.

I generally don't go for grassing people up but I do believe confidential means confidential. Patients have to be able to trust all staff in a medical environment.

It doesn't sound as though you have been confidential about it if all your mutual friends know. There was no need for anyone else to know surely. Your friend is the one in the wrong, should have known better.

You won't hear back. They don't need to disclose anything to you about the process or the results of the audit.

But you were right to report her.

NHS employee here too. Karen needs to go! Not only has she looked into records inappropriately ( to snoop, let's be honest) but from what OP wrote, she appears to be totally lacking in self-awareness by minimising her gross breach of patient confidentiality. Such mindless arrogance is breathtaking. Well done OP, you undoubtedly did the right thing and probably stopped somebody else having their confidentiality being breached too. Can't understand why your friends are defending Karen, that's just beyond my comprehension.

Don’t feel bad. She went too far wielding her little bit of NHS power. That's not okay and she should be disciplined! She did wrong and she should answer for it. She's the wrong person for the job and she chose to do this. Fuck her!

Wow I cannot believe she done this. You are 100% right for reporting her. How dare she look people up just for her own nosey needs? I'm an RN and I wouldn't dream of ever doing anything like this. Even if I was a nosey twat I still don't think I could bring myself to do it for the sheer worry of getting sacked anyway! Let alone all the other reasons why you just wouldn't do it! She deserves to lose her job! And your mates would be ok with her looking up shit about them? Don't think so.

Did she access your records appropriately because she was clerking a clinic? In which case she is still wrong for disclosing confidential information but may be disciplined rather than sacked. Completely unacceptable either way.

You know it's not the first time that she has accessed patients records - due to her very casual way of sharing information to anyone that would listen. She will be sacked because of her own stupidity - and rightly so. The NHS need to present a veneer of confidentiality - even though there is a good chance that staff snoop under the guise of providing care - but the clever ones don't share their findings.