Annoyed that GP have not removed details

[hellodolly2x2]

I went for a mammogram in the summer and seen the results had been posted onto my NHS app.

However, under my results also shows a lady’s results including her name, address, phone number, DOB, NHS number. Including her results.

I’ve called GP multiple times since July for this to be removed and asked for Practice Manager to call me as I’m unsure if my details have gone anywhere to.

I know this could be a clerical error but also a GDPR breech. Advice now please. Tia

Maybe there’s a department you can contact in the NHS rather than your GP’s as I imagine they will have editing/admin capabilities over the app, I’d give it a little bit longer and if not contact the CQC

YANBU - that is really bad. Have you written to the practice to flag this up? If there's no response from the practice I would consider complaining to your local ICB.

That's awful and a definite GDPR breach, and of sensitive data too which makes it even worse. Was it your GP practise that uploaded the results to the app or the hospital? If it's the hospital then contact them, if it was the GP practise I'd escalate it to the partners of the practise.

It's unlikely the GP has the access to remove the results. You need to report this to the information governance team at the hospital that did the mammogram or their caldicott guardian

I don't think the results would have been added by the GP surgery, it would surely have been an administrator at the hospital. I would approach PALS.

That’s really bad. If this was through the screening service, I’d contact them
immediately.

GP reception said they uploaded it. I went to a mobile unit for the mammogram.

You need to put this in writing to the practice manager at your surgery and copy your email or letter to the Caldicott Guardian at the hospital or Trust where you had your mammogram.
Nothing else will work, particularly not phone calls.
You will find the name and email address of the Caldicott guardian you require on the hospital or Trust website.
If you can't find it, contact PALS and ask them to supply you with the Caldicott guardian's name and contact details. PALS cannot do anything about the data breach.
Put "serious data breach" in the subject line of your email.
Include all the relevant names, dates, places.

This happened to me also and I had to complain to the Practice Manager.

My son went to A&E about 3 years ago. When he was discharged he was given a woman’s notes who’d had a miscarriage. Terrible.

Ok in which case then a written complaint to the Practice Manager if they haven't done anything about it in four months - referencing the Caldicott principles and copying in the Caldecott Guardian: https://www.ukcgc.uk

Report it to the information commissioners office they will take it seriously that your GPs not sorting it.

First rule of NHS communication:
If it isn't written down it never happened.
Phone calls are generally a waste of time.
Anything important has to be in writing, preferably to the correct person.

The GP probably doesn't know and isn't allowed to remove anything from records anyway.

I’d tell the Information commissionaires office.
they will fine the gp. I think it’s up to many tens of thousands.

Why would they fine the GP?

They could fine who ever is responsible for the data breach. https://ico.org.uk/for-organisations/law-enforcement/guide-to-le-processing/penalties/
Details are in the link above.

Edited to add you may be able to contact the NHS health trust and ask to speak to their data officer or Information Office. I can't remember the correct term off the top of my head but someone should be responsible for ensuring that any data collected is stored in adherence to data principles.

Yes of course, but I doubt that would be the GP. It is much more likely to be the person employed by the breast screening provider responsible for loading results into the NHS database. I feel sorry for GPs tbh, getting the blame for everything.

If the GP receptionist said they uploaded it, then definitely written complaint to practice manager. Often, the practice manager is the Caldicott Guardian and if they aren't they will know who is.

But the OP has said the receptionist at the GP confirmed it was them who uploaded it.

A lot of the documents within the NHS app are uploaded by the GP, not the hospitals. And the GP practice has said they uploaded. Incorrect information absolutely is removed from records.

Honestly - at this stage I’d go straight to ICO. Make sure you take a picture and any evidence showing when you contacted them and let ICO do the work.

That’s a massive GDPR breach. Agree get it in writing to the practise manager and then take it further if not actioned.

They fine the gp because they have breached the rules. This will sharpen up the gp about such matters in future.

Honestly when i think about it, that means the practice will have even less money. Which is bad for patients.

so in retrospect I think writing to the practice manager yet again would be best. But putting in that they have seven days to respond or youll go to the ica and they will be fined. We got told we could be fined £40k if we arse up something but that was a while ago and it’ll be more now.

Little update:

I went into the surgery today and mentioned about the ladies details still present on my app. Receptionist was great and removed them straight away - apologised profusely and said practice manager has had some personal family issues these past few months.