GP Surgery has given my medical history to another patient

[darreni]

I received a call from my GP surgery yesterday and they stated that had printed my medical history summary and given it to another patient in error.

The other patient took the information away and apparently returned it to the surgery later that day when they realized it was not theirs.

The surgery then asked me what i wanted to do about the issue. I suggested that they check their own/NHS data protection reporting requirements and send me a copy of the data supplied to the other patient.

Today after asking again, I received the data. It's as bad as it could be, name, address, date of birth, NI number, NHS no, hospital number, email, mobile and full details of my health conditions (some incredibly sensitive) & prescriptions associated with those conditions and test results inc bloods etc.

The surgery are trying to play it down and suggested that they may be able to get the other patient to sign a disclaimer to say they have not read or made copies. I'm not sure i'm particularly interested in that. They have also said that their Data Protection Officer is not sure it warrants reporting to the ICO, which i find hard to believe.

I am seriously annoyed and would welcome any thoughts or advice.

[actionpotential]

I agree that's a big error.

If you feel aggrieved (and you've every right to be) I would make a direct complaint to the ICO https://ico.org.uk/make-a-complaint/ including the fact they feel they don't need to report it.

Sorry to hear about your anal warts.

[otolith]

One of the companies I am involved with has reported itself to the ICO for far less. They replied and said that they were satisfied with how the matter had been dealt with and no further action. There is nothing to be gained by them not reporting it, I find it bizarre that they would not.

[Bill]

As annoying as it is it's a minor error in the grand scheme of things with no long term ramifications so I can't see that the ICO will be interested.

What do you want as a solution?

[Bill]

otolith said:

There is nothing to be gained by them not reporting it

It's all work and takes time, if they can mollify the OP without doing it then it makes sense.

[otolith]

Bill said:

It's all work and takes time, if they can mollify the OP without doing it then it makes sense.

I would be interested in how the mistake happened and how they will make sure it doesn't happen again.

[Batfoy]

Bill said:

As annoying as it is it's a minor error in the grand scheme of things with no long term ramifications so I can't see that the ICO will be interested.

What do you want as a solution?

‘A minor error in the grand scheme of things?’ In terms of protecting a patient’s data this is about as big an error as it gets, short of plastering it on social media.

OP has every right to feel aggrieved.

[Bill]

Batfoy said:

OP has every right to feel aggrieved.

I didn't say otherwise. But it's just a single set of data handed to one person. It's not like they've published a load of details online or sent his info to everyone on a mailing list. By data breach standards it's small fry.

[SHutchinson]

I bought my house from a GP who was the on-call doctor for the local Police force. When I cleared the office above the garage I found roughly 5000 copies of the paperwork relating to them being called out to attend to someone during their arrest. The paperwork included the 3rd parties full name, medical condition and details of treatment given.

I class this as pretty sensitive. I called the ICO to ask for advice. They asked if I could pop them in my recycling bin.

Based on my interaction with them, I wouldn't imagine the ICO to go tearing around to your doctors surgery to conduct a full audit.

Edited by SHutchinson on Tuesday 3rd June 14:35

[darreni]

I live in a small village, it's a village surgery. The likelihood of onward disclosure in this environment is greater than in say a city.

I'm annoyed to say the least, not helped by the surgery's apparent indifference.

I do appreciate that the genie can't be put back in the bottle.

[LimmerickLad]

Ask for a full, unreserved apology, an undertaking that the matter will be investigated, detailed explanation given and steps taken, whilst reserving the option to take further action should the breach ultimately prove to cause you any form of harm or inconvenience in the future?

[Batfoy]

Bill said:

I didn't say otherwise. But it's just a single set of data handed to one person. It's not like they've published a load of details online or sent his info to everyone on a mailing list. By data breach standards it's small fry.

No it isn't small fry. I'm really not sure what you're measuring this against, it stands on its own as a major error from a healthcare perspective.

[Riley Blue]

Batfoy said:

Bill said:

I didn't say otherwise. But it's just a single set of data handed to one person. It's not like they've published a load of details online or sent his info to everyone on a mailing list. By data breach standards it's small fry.

No it isn't small fry. I'm really not sure what you're measuring this against, it stands on its own as a major error from a healthcare perspective.

I tend to side with Bill. It's one patient's details disclosed by mistake to one other patient who may not even have read the details. It hasn't been done maliciously nor for commerical gain.

If it had happened to me I would expect an unreserved apology and an assurance that the error had been investigated in accordance with NHS and ICO requirements and that measures had been taken to ensure it cannot happen again.

[The_Doc]

Official policy on this from the DoH

https://transform.england.nhs.uk/information-gover...

Lots should happen now and you should be approached with Candour (which is an official thing) and a reponse with explanation.

The part of the NHS that caused this to happen has to stand up and account for itself now.

[Batfoy]

Riley Blue said:

Batfoy said:

Bill said:

I didn't say otherwise. But it's just a single set of data handed to one person. It's not like they've published a load of details online or sent his info to everyone on a mailing list. By data breach standards it's small fry.

No it isn't small fry. I'm really not sure what you're measuring this against, it stands on its own as a major error from a healthcare perspective.

I tend to side with Bill. It's one patient's details disclosed by mistake to one other patient who may not even have read the details. It hasn't been done maliciously nor for commerical gain.

If it had happened to me I would expect an unreserved apology and an assurance that the error had been investigated in accordance with NHS and ICO requirements and that measures had been taken to ensure it cannot happen again.

It doesn't really matter what the layperson might think, from a healthcare perspective it's a serious error. Patient confidentiality is absolutely sacrosanct and any breach is taken very seriously, it's just how it is.

[dandarez]

I was just going to point to that NHS Personal Data Breaches, interestingly it's been updated again in Feb this year.

For the orig poster, that is a 'serious' error, not minor.
More especially in this day and age with what is going on in this country and the world.

There are some truly and really wonderful people working in the NHS, and a few who shouldn't be within the proverbial mile of it.
I've met both!

From my own personal experiences no other profession covers it's arse like the NHS.

I'd personally report it to the mainstream media if I got no joy.
That will go a long way to prevent it happening again.
Accept their apology and like night follows day it will happen again...
to some other poor soul.

[juice]

I would certainly be expecting them to pay for a fraud monitoring service (e.g. experian) for at least a year. As the others have said, patient PII is protected health information and (should) be held to an even higher standard of protection, so they should deffo face an ICO investigation !

[otolith]

Asked my other half (GP, until recently senior partner) and she certainly didn’t think it was a “minor error” or something you could swerve the paperwork on.

[JoshSm]

Riley Blue said:

I tend to side with Bill. It's one patient's details disclosed by mistake to one other patient who may not even have read the details.

Depends on how many other people the same type of mistake has happened to.

And just because it hasn't ended badly (hopefully!) isn't exactly mitigation of the original failure.

[OMITN]

Patient data is “special” category data, so has to be treated more carefully. What the OP has described is straight into special category.

Definitely push the practice to follow the NHS protocols - they will be required to as part of their NHS contract.

The ICO will, to be polite, do very little. You are free to report the breach yourself, even if the practice’s DPO does not think it meets the reporting threshold.

OP - you are right that the damage is done to you. You can’t undo that. But, as a patient and member of the public, you are 100% within your rights to insist that the practice follows the rules in managing this breach and ensuring this doesn’t happen again.

A couple of other things to note:
- Legal case - the nature of this breach sounds very likely to fall below a de minimis threshold and, as such, you would struggle to bring a successful claim. However, you may want to consider this approach as a method of making the practice fulfil its obligations.
- GP practices are not part of the NHS. They are private enterprises that contract with the NHS but are obliged to follow NHS rules on many things, including information governance.