Patient Confidentiality ...I'm Worried

[rick2525]

So last week I visited my GP practice to give blood sample on Tuesday. I will post the results and ask advice on another blog. I went into my online NHS records to view my results and was shocked to find another patients recent report in my records. They have the same name and date of birth as myself but it has my NHS number on the record. The document states the "other patients address, which is 70 miles away from where I live. It gives their phone numbers and also confidential information of the patients treatment. This is on the new NHS system which ALL GP surgeries have switched over to in the past 2 months. I am in a state of shock to be honest. I am now wondering if my information has been sent to someone else as I am waiting for a letter of referral from GP for Endo appt.I am thinking of telephoning the other patient because I think he needs to be aware of how his confidential medical details have been breached. I have never come across this situation before. When the NHS set this new system up I had to provide the GP surgery with my passport ID even though I have been a patient for 62 years st same practice. It has rocked my confidence. I now am wondering are my blood test results mine or someone else!! I have taken no action on this breach yet. What does anyone else advise here. ? If this can happen to me. How many more can it happen to.

[helvella Administrator Thyroid UK]

In addition to contacting CQC and surgery, urgently contact the Information Commissioner's Office.

ico.org.uk/

And take copies of everything. Screenshots. Print to PDF. Save web pages. Anything. Even photos of your screen (but make sure they are legible).

You need to get the evidence now. It could disappear without warning if the issue gets corrected. Then you'd end up in a "your word against someone else's" situation.

Obviously do NOT pass that evidence on except when you have made absolutely sure the basis on which you are doing so.

[rick2525 in reply to helvella]

Hi helvella. I have done as you suggested and posted the reply to serenfach. You will see I spent hours yesterday on the phone and computer and got no answers. It's a terrible situation to know your confidential information has been compromised. Left feeling helpless really

[serenfach]

Before you contact ANYONE, get the evidence. As helvella says, this sort of thing is liable to disappear. A whole chunk of my medical notes went missing after a complaint.

Personally I would not contact the surgery, but go straight to the CQC and Data Protection Office Information Commissioner’s Office and ask for advice, but that is up to you and how you get on with your practice.

I know it is a shock, but it is not uncommon unfortunately. The new NHS system should not allow information to be added if all the key data does not match, and this is worrying for us all. Such a basic thing that can be built in to a database so easily should have been a huge priority. I am sure this all has left a sick feeling and distrust in people you should automatically trust. I hope you can get this resolved - let us know how you get on as it could be any one of us in the same situation. Hug.

[rick2525 in reply to serenfach]

Thank you Serenfach for your reply. You echo my feelings towards this issue. I have a very good relationship with my GP practice and been at the same for 62 years however I believe this is not of their doing or fault and the fault lies with the system the NHS has introduced. I have been into the practice since this system was functional and witnessed first hand the difficulty the staff are having negotiating their way around the system to record everything. Indeed the GP's now spend most of the 10 minutes you have allocated to them tapping away on the computer rather than listening and addressing the patients medical symptoms you have called in to see them about. This "visit" appointment has been devalued to nothing more than a tick box exercise.This morning I will contact the CQC and the ICO and the other patient whose details I have on my system because he also has a right to know that his confidential medical notes have been distributed to third parties.

[rick2525 in reply to serenfach]

Hi . I took your advice and printed off the evidence and took screenshots etc. Then I rang ICO who bluntly told me it wasnt their jurisdiction and said it was the responsibility of the NHS to report the breach to them!!! I remonstrated that they are hardly likely to do that! Its shooting themselves in the foot. ICO advised me to report it to NHS.@dpo. Ie their data protection dept. So I emailed them. Within 2 hours a man rang me to say it was not their responsibility and I should contact the ICO. I said they have asked me to ring you. My own GP surgery thanked me for reporting it to them, but could not explain it. Quite frankly I feel I've been given the run around for hours and been stone walled by institutions protecting NOT us but themselves. !! It stinks of cover up. I'm thinking of sending the info to my MP . Do you have any suggestions

[helvella Administrator Thyroid UK in reply to rick2525]

The ICO have a tendency to deny responsibility but they are very clearly the ones overseeing everything and must accept your report. (Even if you have to shout very loudly for them to hear.)

Says a lot that you are putting this effort in. Thank you on behalf of all who are or might be affected.

[Mymble]

How awful for you. I don’t know if this helps but here is a link to ICO guidance on reporting the misuse of personal data to the organisation who has committed the breach ico.org.uk/your-data-matter... It looks like you have to give the organisation the opportunity to deal with your complaint first but given the seriousness of this breach I would have thought your surgery is legally required to report the breach to the ICO. However, as it is not your data (as far as you know) I’m not sure how much information they will give you. Hopefully they will be keen to reassure you of what they have put in place to prevent it happening again.

[rick2525 in reply to Mymble]

Hi. I've just phoned the Parliamentary Health and Ombudsman service and they have logged my complaint re misuse of confidential patient information. Given me a reference number too and have confirmed it is the ICO office to report it to. Even though I explained I was fobbed off by them yesterday. So I now have to take it back to the ico and if they dont respond the Ombudsman says I will have to take a complaint out against them. No wonder people get beaten down into submission by these depts and throw the towel in. He also mentioned the NHS dpo. I said they were a waste of time too. Just fobbed me off. I'm rather annoyed the "evidence " has just disappeared from my records. Good job I copied it all beforehand. I'm finding it very stressful

[serenfach]

Stressful indeed. I had the same run around with GP, lab testing, Welsh NHS, all sending me to someone else and no one saying they were responsible, and send you round the circle again. I think it is built into the system to get people to give up and go away. And it works, especially if you are ill.

Did you get the name of the first person in the ICO? You can then put in a personal complaint that this person was not doing their job, a job YOU pay for.

Good job you got the evidence - there must be a carpet 20ft off the ground with all the evidence that gets swept under it!

You will not be the only one this has happened to, if the database is not secure, and others will find the same thing in the future. I could write a database that needs certain info before other info is added, and I am a spreadsheet person, not a database person! The NHS number should be the primary key.

I know it is difficult, but do try and keep going - you may save someones life if they fix the problem.