My “friend” looked at my medical record.. Question for anyone who works in a NHS hospital

[AdviceNeeded3282]

As the title says. A friend of mine who works as an admin in the back office of a hospital has access to patient medical records/information. One night out she openly admitted that she has looked through people’s medical records?!?! (My guess is it’s all computerised). I was gob smacked to say the least. She found it funny/said it was interesting then realised I was angry. She openly admitted she has looked at all of our (close friends) records. My guess she has looked at my DH’s and anyone she is friends with? Anyhow about 2 years ago I went to my GP as I was suffering with depression which I told NO ONE about. This was at my doctors, not my hospital. Are all the systems linked ???? I do not want her knowing my private business like this. Before you say you should report her, I am not going down that road.

Or course she knows it’s not right.

She will have done her IG training.

Completely unacceptable and her casual attitude suggests that it may be cultural in her department. It really needs reporting, not just because she is doing it but either she hasn’t been trained properly (unlikely) or everyone is ignoring their training and nosying on their mates

I work clinically in the NHS. I wouldn't expect hospitals to have access to GP records. However your friends behaviour is outrageous and if records are computerised it will be easy to detect inappropriate behaviour.

weetabix - yes you are right that it's much harder to prove if the friend has accessed paper notes rather than electronic notes. But it may still be possible to find out, as- unless the friend happened to stumble across them in a batch of other paper notes (eg your example of the clinic receptionist) - to locate notes in the records library the friend would need to look on the computer system to find out the patient's hospital number etc - it's v unlikely that notes would be filed alphabetically. and there would be a way to audit that search on the computer system.

When I worked at a gps surgery management could tell when youd accessed a record,If they wanted they asked you why you went into it,I think most places have this technology.Id report anonymously if she's told a few she won't have a clue who it is

Not linked as such where I work but I have access to all results of tests that are ordered in the hospital and by GPs. Can also check on appointments and inpatient info. The dept where I work also has all patient letters saved on the system from clinic attendances.

Yes, you should report her.

Her workplace will be able to see that she’s looked at records, but they won’t have any reason to check and discover she’s looking at people she has no cause to access without being told. Yes, she could randomly be audited, but who knows how long that will take or how many other people she’ll have done this to in the meantime?

OP, if you’re not a totally selfish person you really do have a duty to report this. You might be willing to let it go that she’s done it to you, but it’s not all about you.

I’m a bit confused why you’ve even posted here if you’ve already made your mind up not to report to be honest. You know it’s wrong, you don’t need ten pages of posters begging you to change your mind and report. either you’re the sort of person who knows this is wrong and will act on it, or you’re the sort to stick your fingers in your ears, go ‘la la la’ and look the other way so you’re not inconvenienced.

@tidaquel wtf ? The rules should be that strict and absolutely made clear from the outset, but how can they make your family and friends leave the practice? If I was registered at a practice I was happy with and was convenient for me to access, I would expect my friend to be trustworthy and would refuse to move practices. That's ridiculous and how do they enforce it?

how would they proove anything?

The database administrators will have logs of which user accessed what and when.

She's fucked. Report her.

Even if your friend came across information about friends as part of her job she should report it as soon as she realised and pass that case on to someone else. She shouldn't process it any further.
That's what would happen in a bank anyway: if I take a phone call and realise I know the person (even loosely) who is calling, I am not allowed to proceed with the call.

To purposely go through records for no medical/admin reason is not allowed.
Your friend may have needed to look at record, she still shouldn't have said anything!

DPs exGF worked as admin at my DRs, I went to DRs to have pregnancy confirmed. 2 days later she emailed DP congratulating him! Luckily, I had told DP I was pregnant. DP asked how she knew, she said she had to send referral off to midwives etc. I was beyond fuming. I didn't report as she had a young daughter (not DPs) and she was single. I couldn't take that little girls security away.
But, what I did do is tell her that I will report if I ever hear she has done that again, I will always have those emails!

With regards to your friend, I would tell her that you are disappointed in her abusing her power like that and if she ever mentions anything else about yours or anybody else's records again you will report.

This has an insidious affect on trust with the NHS, as these kinds of concerns are why lots of people dissent from having their records shared.

I work in a community rapid response team, it's really difficult when you're rushing out to someone in crisis and the systems won't link so you can't get accurate relevant health information because they haven't consented to sharing. And often the reason they don't is because of people like your friend.

If people who are tempted to do this knew they'd be reported and loose their jobs I think they'd find it less "funny/interesting" in the first place.

Wow. I work for the NHS (mental health) and this is a sackable offence. I once got pulled up because I was on the record of someone with the same surname as me (all fine)

I would urge you to report her, think of all the other people she has done this to. And for what gain?!

This person will have done her IG training. She will know it is wrong.
Please report to head of Information Governance at the Trust.
If she has accessed electronic records there will be a trail.
It is a clear breach of trust and the terms of her employment.
I understand it is difficult when it's a friend but this is gross misconduct.

There will be logs of every single file she's been on. It just may not have been flagged up yet, but all she has to do is search one wrong person and they will look into all of her history.

This is completely unacceptable and needs to be reported. If she is blatantly boasting about accessing records what’s to stop her discussing what she’s found. You may not have anything to you don’t want shared in your records, but her other friends and family. Everyones medical records contain very sensitive information. The are private for a reason and should be used be anyone as the latest hot gossip.
You really do need to report this, her actions have breached so many rules for NHS employees and accessing electronic records leaves a footprint of whoever has accessed them which can be investigated.
This is unlawful and unfortunately widespread in many NHS areas, turning a blind eye only allows it to continue. Challenging the individual on their behaviour doesn’t address the problems as the information the have gathered may never be discovered until it is fully investigated.

As part of my job I go through patients medical records all day. Any persons records that I look at is recorded and is available for audit so I would be held accountable for anything I look at. Her hospital hospital IT department will be able to tell if she's accessed any of you or your friends records. This is a stackable offence in my trust as I would expect it to be in any trust. On the system we use there in big red writing is a warning to only access records that are relevant to our jobs. I can't understand why you wouldn't report her? She has massively breached your trust.

Hospital and doctors records are not linked. If you have a referral from your gp to the hospital usually the gp includes a list of medical history and depression and anxiety would be included on there. Like I say as part of my role I read through both paper and electronic records, I would be horrified if I knew someone who was meant to be my friend had accessed my records. You seriously need to report her.

HamishTheTalkingCactus

Thank you for explaining that. I've always wondered how secure the paper notes are. It's reassuring that there are some checks in place even if they can't be 100% secure.

Stop covering for her and get her bloody reported. Just as she shouldn't have done what she did, you cannot in good conscience know what she's done and not say anything.

It's like she's declared to you all that should she want dirt to dish in a gossip opportunity, she has it. How many more groups of people is she doing this with. Will she really be looking at all this information, telling lots of people she can see it about them and other people and yet never telling a soul any of the information? That tempting others to push her to tell them. If she's prepared to look, she's prepared to share.

Ex NHS employee here. It is made clear to employees that you are not permitted to do this and the likely consequences. Your friend knows this is wrong.

I agree with previous posters, I think you should report it anonymously. Call the hospital and ask to speak to somebody in Information Governance.

You have nothing to be ashamed about OP.

if you don't want to put in an anonymous report, can you share with everyone she knows that she's done this? She told you quite freely it seems.

it would be even better if you could get her to disclose her behaviour herself - e.g. in a group.

then stop being friends with her. But I'd still be inclined to report, even if you do want to do it anonymously. There are numerous ways to track what people do on the work PC, of course they can find the evidence of what she has done.

I'm fairly disgusted by you op. Sorry but I'd be more ashamed letting her away with it if I were you.

Please, please, please report her OP. You will not be the one who means she loses her job, her behaviour will do that for her.

I will report her anonymously - I know the hospital she works for. It’s a trust so is linked to a few local hospitals. I am unsure of how much info she has access too but regardless I know it’s wrong. I’m guessing she must work on an electronic system. What would I even put in my letter?! Do you think the NHS would investigate? She does ‘bank work’ for the NHS so she’s not permanent anyhow