Can I find out who has accessed my NHS records?

[Fluffytowelette]

how can I see who has had access to my nhs files? I have a friend who works for the nhs and she’s led me to think she has accessed my files and I’m not quite sure if it’s possible to easily see who has accessed them? TIA

If it's the hospital ( PALS) or GP you can ask them to run a check to see if your records have been accessed inappropriately. If you provide the person's name it would make it easier.

Anyone accessing a patient’s notes has to sign into the system and their name is noted on the file so unless she has used someone else’s login - and that’s unlikely - it will be easy for a manager to see who has accessed your file. If she is unauthorised to access it that raises a query too ie she works at a GP surgery and you aren’t registered there for example.

They won't tell you names of all individual staff as they are also entitled to have their data protected but if you specifically mention the person's name and you suspect they have illegally accessed your records it will be investigated.

A person can only access your NHS record if they have a clinical need to do so. If she works at the hospital, ask PALS to investigate. If she works at the GP surgery, they can also tell who looked at your record and when.

Can someone for example up north access my nhs records and i live in the south? Or would they be denied access or require some kind of permission to view or?

@amraa nhs records are seperate for each hospital you go to, so someone who works in a hospital in the north couldnt access the records for a hospital in the south unless they requested for them to be transfered there and that would raise a load of red flags of therr wasnt a reason.
Everyone who views the records is logged so of people are doing it when they shouldnt there is a record which can be tracked.

Not sure if it’s true for all records but several people were caught accessing the medical records of the poor little boy that got thrown into the crocodile enclosure just because they were being nosy / without need - so there must be ways

If she works for an NHS trust you could do a google search for the Caldecott Guardian for that trust, this would fall under their remit

Thanks, so can I simply ask my GP to check if anyone has accessed my files that is out of the ordinary? Or would GP already have let me know because they noticed it?

I wouldn’t want to name the person initially, in case they get into any trouble and I’m wrong?

The person won’t get in trouble if they haven’t accessed the records. But you do have to name them to enable a proper check.

is this gp records or hospital records?

Your GP or any other health professional woulsnt know who had accessed your records - they don't get a notification when records are accessed.
There will be an set up where and IT person goes into the administrator system and looks through records of access over a period of time.

You could contact your GP practices manager, and tell them you think your friend (who i presume works elsewhere but still in nhs) has accessed your records, and ask what action they can take to look into this.

Or you can contact where your friend works through PALS and tell them you think someone who works as X place has accessed your records and ask them to investigate.

I work in the NHS and wouldn't ever have a legitimate reason to access records of someone I know.

The clear expectation is to remove yourself from a case etc as soon as you know that the patient is known to you.

Every trust has a different system I think - but at ours, you can click through various settings on the hospital record to give a list of "this record was opened by"...followed by name and date.
Its pretty tricky to find and not something thats in your face, so your clinican wouldnt see straight away that Susie Bloggs had opened your record - and even if they could see it, Susie might be a receptionist they haven't met yet, so it wouldnt raise a red flag. This is why it would be helpful to have the name of the person youre asking about.

GPs cant see this and use a different computer system, which I know nothing about.
So it would depend whether the person you're wondering about works for the hospital or the gp.

You need to ask the information governance team where she works for an audit of who has accessed your records and the time period you want checked. If it is a GP surgery probably best to request this from the Surgery Manager. If it’s a hospital then Information Governance team is best

Good advice from past responders.

I work in this area and confirm to either contact PALS at your hospital or the practice manager, if she works at your GP Surgery.

There is an audit trail of username, date and time stamp on every record for most NHS IT systems. This covers edits as well as views of the patient record.

This isn’t actively monitored though, it will make it easier for the teams to check if you provide her name as otherwise they will have a list of potentially 100-1000s of transactions to check through. Most of which I would expect to be legitimate staff views. E.g.If you are booked for a blood test by the GP, to be
collected via the clinic at the hospital, between admin staff, the phlebotomy team and then lab staff who process the samples it could run into 100s for ID check, result history etc before it gets to the final clinician at the GP reviewing the results. That’s a single blood test event. Add in your historic contact it can easily be 1000s.

If for example your friend works in none of these areas it may be identified when you ask, but if she does, the team will be unlikely to be able to investigate anything without you providing her name as she will be within the assumed access group. E.g ‘booking team’ ‘phlebotomy’ or ‘pathology’

It’s covered in staff training at all NHS trusts as part of onboarding, all staff know the line and risk to their employment for breaking the agreement. It will be handled appropriately if you raise it.

Hope that helps!

Its pretty basic that nhs staff known not to access records unless for clinical reason. Its on training which needs to be completed every so often.

This is the correct advice. The Caldecott Guardian in the setting where your records are held, whether that is your gp surgery or your hospital, is the ONLY person you should contact. That is the correct procedure and will ensure that your concerns will not be seen by or mentioned to anyone else in the setting.

Sorry that should be Caldicott.

Unfortunately it still happens.

In Primary care, can other GP’s who work in a different health centre, access any GP medical records?

It depends on what system that particular Trust uses. We used to use a system called RIO and on that system they can do an audit of who has accessed your records without naming anyone in particular. I’m not sure about other systems.

Yes request a subject access request under GDPR law and also an audit trail of who has accessed records.

No we can’t access unless they are registered with us.

How can they get into trouble if you are wrong?
Had X accessed my file inappropriately?
No.
Ok.
The End.

Absolutely it does despite the training. Only saying it though as OP is worried about getting someone into trouble if she was wrong. If she's wrong, nothing will come of it. If she's not wrong, the person who has accessed her record has done something they 100% know they should not be doing.

Just to say that whilst it would be easier to name her when you request the audit you don’t have to so if this worries you then don’t. You can just ask for an audit of all who have viewed your records and the time period you want checked. I had to do this and didn’t name the person until it was confirmed. I got the audit back and they had looked at my records.