Local Health authority breaks GDPR

Wibbles

My local health authority has broken GDPR by sending a personal email to my father rather than myself. The person concerned apologised telling me "sorry - I got your email from online notes" but as far as I am aware, they do have my actual email address...

Luckily - it was only information concerning a wheelchair assessment - but the sender had no idea whether the recipient was my father or someone unrelated to me !!

Jimm_Scope

That's a pretty serious concern, everyone sending emails with potentially personal/private information should have GDPR training. 

While in this instance it didn't have a negative outcome, that is never something you can assume. I personally would raise a complaint about it, but of course it's up to you what course or action you take. Even though, I imagine, they were just trying to be helpful it can be quite detrimental/harmful just sending out personal info without knowing who is actually receiving it.

Wibbles

My GP surgery uses read codes to stop patients from knowing what is really wrong with them

The latest on my record is Letter received (XaKqd)

I have googled XaKqd and can't find it

Does anyone know ?

Jimm_Scope

qd usually means "everyday/daily" Abbreviations you may find in your health records - NHS App help and support - NHS (www.nhs.uk)

They don't have one for Xa but you should be able to ask your surgery what it means. Could it be a new medication you're supposed to now take everyday perhaps?

Wibbles

Jimm_Scope said:

qd usually means "everyday/daily" Abbreviations you may find in your health records - NHS App help and support - NHS (www.nhs.uk)

They don't have one for Xa but you should be able to ask your surgery what it means. Could it be a new medication you're supposed to now take everyday perhaps?

As far as I am aware - surgeries were supposed  to stop using these codes - years ago - but mine still does !

Jimm_Scope

Yes, I do remember while searching for the code information that they were supposed to stop using them in the late 2010s, because they were confusing to patients. I assume your GP has just "stuck to their ways", I know some of the older GPs at my surgery struggle to change to new and more transparent processes.

Wibbles

Jimm_Scope said:

That's a pretty serious concern, everyone sending emails with potentially personal/private information should have GDPR training. 

While in this instance it didn't have a negative outcome, that is never something you can assume. I personally would raise a complaint about it, but of course it's up to you what course or action you take. Even though, I imagine, they were just trying to be helpful it can be quite detrimental/harmful just sending out personal info without knowing who is actually receiving it.

I asked the person concerned why/how it happened and I received an apology but no explanation - since my father has never had any dealings with the department concerned (OT)

Wibbles

Jimm_Scope said:

Yes, I do remember while searching for the code information that they were supposed to stop using them in the late 2010s, because they were confusing to patients. I assume your GP has just "stuck to their ways", I know some of the older GPs at my surgery struggle to change to new and more transparent processes.

I have asked the surgery for a copy of the "received email" - I bet that my medical records are updated to "lose" the message now !

teecee

Wibbles said:

My GP surgery uses read codes to stop patients from knowing what is really wrong with them

The latest on my record is Letter received (XaKqd)

I have googled XaKqd and can't find it

Does anyone know ?

Asking too, who has answers please 

kc1978

Hi @Wibbles
So if the the GP has breached data protection firstly, you should find out if they have a DATA Protection Officer. In NHS this person is usually called a Caldicott Guardian.
They are senior NHS staff who are responsible for Data protection. 
Make a formal complaint ensuring they are the person who is notified/investigate your concerns.
If you are unhappy with there response complain to the 
ICO (Information Commissioners Office) who are the body who have responsibility and ability to take actions including sanctions against organisations who are found to have breached data protection legislation.
They will not usually get involved if you have not allowed the NHS trust responsible for the GP to do an investigation and respond to a complaint first.
The NHS does use codes for many reasons this is not an abbreviation. Example
SOB = shortness of Breath. However when this was read
 A patient thought it meant Son of a B****
MS = Multiple Sclerosis

The (XaKqd) code could be a demographic, funding codes and I am glad that these are not widely known, as there are certain situations which need to be coded to protect individuals rights. It's not always a suspicious reason. There are genuine needs for information to be coded.

Ask them what this refers to as it's in your records they should disclose. 

Accessible records is really important, so they should be willing to discuss this with you.

However I also understand that some discretion is required. Especially with the amount of cyber attacks/hackers who are out there. 

I would definitely complain as your right this is an unacceptable breach of your rights. 

wizzy101

So does anyone know what the code is?