I’ve reported my friend for an NHS confidentiality breech

[BundleOfCookies]

I have a (now ex) friend who works for the NHS who works as a clerical officer who we’ll call Karen. I’m in the early stages of pregnancy and haven’t told anyone other than my dh. Had my first midwife appointment and since this, I’ve had some congratulations texts from people within my friendship group. When I queried how they knew I was pregnant, they said they heard it from Karen. When I asked Karen about this she said she saw it on my file, and shrugged like it wasn’t a big deal. I’m really upset that she’s just looked me up on her hospitals system like this. She works where my appointments are and openly said that she’s done this and has done it to a few of us in the group so she knows what’s going on. It’s my first pregnancy and I’m so anxious and I’m so upset so many people know about it.

At the time I was so angry I instantly filed a complaint to the hospital. Information governance then contacted me to say they’d be conducting an internal audit. This was 3 weeks ago and I’ve not heard anything since. I’m still upset with Karen but I now feel so guilty I’ve done this. I don’t want her to loose her job. Karen knows I’ve done this because I’ve told her and she’s livid and none of our mutual friends are talking to me now.

Is there anyone here who works for the NHS who can explain what happens in these situations? I’m guessing everything is fine because I’ve not heart anything from information governance since but I’m so worried

The harm is;

The OPs personal information being shared with others without her consent. Lots of women don’t like to share that they are pregnant for lots of reasons. There might be all kinds of things on her medical record that she doesn’t want anyone to know. Think of the most embarrassing thing you have been to see healthcare professionals for and then imagine all your friends have been told. It’s psychological harm.

The other harm done here is that all those people who know about this (including us) will now have a little less trust that our health information will be held confidentially. There are many many harms that could come from that including fatalities. If you have embarrassing digestive symptoms for example, but you think the receptionist will share those with your friends and colleagues, you might not seek help and then die unnecessarily from bowel cancer.

It’s really not that hard to see the harm done here.

OP what a gross violation. Well done for reporting her. This is terrible!

It would put people off seeking medical help.

There is a reason why medical stuff is properly confidential.

Once the 'friends' get a letter saying that their personal information has been illegally accessed, despite their small minds, they might actually realise how shitty this actually is.

The NHS is being exposed to litigation here too. OP, you are able to claim for your upset/distress and alarm.

She is utter lowlife.

Terrible thing of her to do. She’ll also probably be used as a case study for future training in the trust. I’d be amazed if she wasn’t sacked but she deserves it for being so stupid. The example I remember in training from years and years ago was that someone who had looked up a friend who was pregnant, started telling people and then that friend lost the baby so was having people congratulate her for a pregnancy that had not progressed. It is an absolute no-no and she’ll have been told that in very clear terms when she started.

PS congrats on your pregnancy

You were right to report her and she’s the one to blame for losing her job. The way she breezily admitted to searching for info on her friends shows she’s blatant and has no intention of following the privacy policies.
Life is going to change for you - make the most of ante natal groups and playgroups to make better friends.

There are audit logs. The system keeps a track of every record you look at, every attempt to sign in, every change that you make. All they need to do is pull her audit and search the OPs name to see what she looked at, when, and what she did in those files, if the friend had no legitimate reason to be looking at taking those actions then the evidence will be clear.

Oh. And another harm done, that’s less important, is that now, most likely, the bloody mandatory training will be even longer because some people don’t bloody pay it enough heed!! That’s a couple of hours of my life I won’t get back and a couple of patients that could have been seen.

Yes! Absolutely. And the litigation thing is the harm I forgot. That is less money in the pot for providing care and more money spent on legal services.

Which part of the NHS does she work for ? I’m confused as to why your booking in appointment with your midwife would be on your central record ( the bit that is accessible to other departments).

Yes. That’s exactly the right thing to do. Even in training, if someone has consented for their information to be shared anonymously as an example, if you think you recognise the details as someone you know, you have to leave. Confidentiality is a bedrock of good care.

Just another voice here to say you have done nothing. You were right to feel upset and angry. She deserves whatever comes to her. Which in all likelihood will be dismissal for breach of confidentiality if patient records .

All appointments are usually on a central system as are any letters unless agreed otherwise. There are then systems within that for more sensitive information. So for example sexual health clinics often have a separate section with an extra fire wall so anyone looking has to ‘break the glass’ to enter which shows up as a more obvious alert.

It sounds like she was looking at all her friends records. The reason is moot though of course. It’s wrong.

This! Dork feel bad, they’re not good friends if they side with her. Shocking behaviour! I made an nhs complaint once (medical negligence) and the report which was comprehensive took 6 months so it may just take a while to be audited

My dad has a long and very large file with the NHS (more than 10 years long) and I think if someone had looked at that and told other people what they had read I would have complained too. As an aside, I would have been apoplectic with rage!

Your friends seem to be idiots, all of them. Time to find new friends.

All that aside, good luck with your pregnancy OP, and congratulations!

I’d be pointing out to your ‘friends’ she’s read their medical notes too - they will soon switch sides.

It's unlikely you will be told much due to (ironically) confidentiality.

You are more likely to get more information from your friends. Who are crap first falling out with you over this.

I'm not convinced there was any harm done here,

It undermines trust in the NHS and the confidentiality of their systems. That’s a huge thing and, as a pp said, can have very harmful consequences if people won’t seek medical help because they lack that trust.

Contrast this with an example I had this week: my DD’s ballet teacher broke GDPR rules this week as she sent out an exam timetable to us with all the children’s full names and RAD numbers visible. That was a) done in the spirit of being helpful so that everyone knew timings, b) wasn’t information that anyone could reasonably think of as deeply personal and c) was likely an oversight on her part. In the OP’s case, her “friend” Karen was basically driven by a prurient interest to find out her friends’ secrets and was done deliberately for her own personal advantage. Totally, totally different. It’s an egregious breach of the rules and she should lose her job, if for no other reason than it’s a pretty big disincentive for anyone else in that position of trust to obey the rules themselves.

What she has done is awful and she SHOULD lose her job. Maternity notes are particularly sensitive due to the nature of what you have to disclose during booking - your entire family history, your mental state, abortions, STDs, domestic violence, drug use, sexual assault - they are far more intrusive than your normal file.

If she has accessed your notes digitally there will be proof as she’ll have had to be logged in to do so. This will mean, especially if she has indeed been doing it lots, that she will likely be sacked for gross misconduct. This is in no way your fault - it’s all on her.

On her head be it
she looked up personal information which is a breach of GDPR
and the friends who are backing her are idiots
you did the right thing OP .who knows whose notes she’s been looking at as well as yours

She really ought have known better. You've done nothing wrong.

All your notes aren’t held in one place. So a booking appointment with the midwife, which would have been arranged via a GP, would not be recorded anywhere but on the GPs files. Even if it was recorded, the details of that appointment would not be.

Just trying to work out what her friend would have been able to see, as that is dependant on which bit of the NHS she works in. From the OP it looks as through the friend had seen a lot of detail, not just an appointment.

100% right thing. My mum used to work at the same drs as me and a lot of my friends. I can remember being like oh so and so has this (she used to do the drs letters) and never ever told me, sometimes she would say after I mentioned something like oh I’m glad you know now. But she would never mention anything it’s part of your job! She was wrong and the friends are wrong too

Yes, they are on the national spine.