Hospital and GDPR

[sparkeyrjp]

Hopefully the corect place for this question

 

I attend a specialist outpatient clinic at a local hospital for a blood disorder , totally under control , so the visits are about 8 months apart .

My last visit saw a change in how patients register attendance .

 

Previously you went to the clinic reception desk and checked in , now you are presented with a login screen .

The login is along the lines , post code , DOB, M/F and from that info it pretty much narrows it down to one person , ok so far.

 

Then , and this is where I have a problem with the system  ,

you are then presented with a screen showing all personal details , full name , address, GP details , Next of kin , all for confirmation .

This screen can be easily seen by anyone “shoulder surfing”.

 

Simple question , before I write and complain to CEO , is this a breach of GDPR and patient confidentiality

[sparkeyrjp]

Please

[honeybee13]

Hi sparkey, I'm sorry you haven't had any replies.

 

I wonder if it's worth speaking to the Information Commissioner's Office, ICO, for more guidance.

 

HB

[sparkeyrjp]

Thanks for advice .

I have spoken to the ICO , and their opinion is that there “may “ be cause for complaint .

In the first instance I should write to the hospital (CEO)citing GDPR, giving them 30 days to respond .

If the response is not to my satisfaction , then back to the ICO to raise a formal complaint .

The ICO also suggested copying in the GMC with the complaint , I feel at present that is one step too far , perhaps I will sit on that until I get a reply from the hospital.

[Manxman in exile]

Our general hospital uses a similar system, but I don't think(?) it displays all your personal details for confirmation at the end of the process.  In fact I'm pretty sure that at the end of the process it displays only the last three or four digits of your 'phone number and you must confirm that this is correct. 

 

Also at my GP's surgery it only asks for date and month of birth together with the initial letter of your surname and then it displays "Thank you.  You are recorded as attending".

 

I would say what you describe is a sort of breach of data protection, but not sure how serious it might be.  (I can see no valid reason for displaying full name and address etc if other hospitals' systems don't).

 

Go to the website of the NHS Trust in question and see what their complaints process is.  There may be two different processes: one for "general complaints" and a separate one for data protection complaints (eg direct to the trust's data controller*).

 

Personally, I would complain down both routes.  Don't, whatever you do, get diverted down the PALS (Patient Advice and Liaison Service) path as they won't be equipped to deal with this sort of issue.

 

As a former NHS manager I'd be interested to know what sort of reply you get.

 

FWIW I'm surprised(!) the ICO suggested complaining to the GMC as they won't be interested.  This isn't a medical staff issue - it's a trust data management issue.  (I'm really surprised at the ICO's suggestion on this - it's bonkers!).

 

*If you can't find out how to contact the Trust's data controller from their website, ring and ask them.

 

EDIT:  I wouldn't allow people to "shoulder surf" me.  Our trust makes it clear that people behind you have to stand behind a line so they can't see over your shoulder.  If anybody was standing directly behind me I would "politely" draw their attention to the notices and "ask" them to stand back.  If your hospital does not make this clear, that's another complaint...)

Edited October 16, 2019 by Manxman in exile
addition

[Manxman in exile]

If I copied anybody into your complaint it would be your local Care Commissioning Group, not the GMC...

[sparkeyrjp]

Thanks Manxman ,

I was only going to challenge the hospital in the first instance , but I will take on board what you say

 

Yes my GP has a login as you describe, minimal information

 

The hospital has a sort of I pad on a stand , no stand back line on the floor , so you feel the person behind you breathing down your neck .

 

As it was the first time I had used the sign in process ,

I was unprepared for the screen to show so much information ,

not the next time

[Manxman in exile]

If you don't want to make a formal complaint then by all means challenge them eg "I'm concerned that the current automated booking in system could be seen as a potential data protection breach because blah...blah..."

 

Also suggest they put a line on the floor and put up notices asking people to respect others' privacy and confidentiality by standing behind it and not "surfing".

 

Let us know what sort of response you get.  I'm retired now but have a professional NHS interest in their reply.

[sparkeyrjp]

I have now received a formal reply from the Director of operations at the Hospital .

 

The reply is positive “You have raised some valid concerns “ and the hospital is acting on my complaint .

The hospital also apologised for the fact I needed  to complain.

 

The check in screens will now only show basic information ,name contact details with the option to continue to confirm other details etc ,if the patient choses not to continue , the screen can be cancelled and the check in done with reception , also privacy screens will be placed around the self check in .

 

In all a satisfactory conclusion , It’s a pity this could not have been foreseen when the system was introduced , but never mind .

 

As far as the treatment is concerned , could not be better  

 

Perhaps the mods could change the heading to resolved

[Manxman in exile]

Thanks.  Good to know they've acknowledged that it could be a problem and are rectifying it.

 

As you say - fairly obvious so why didn't they think of it.

 

Well done.