NHS Letter regarding pers mental health issues sent to wrong address??

[Kallil]

Hello

 

Not sure where I post this,

 

I received a letter from nhs mental health,

the envelope was in my name and address but the letter inside is around 6 pages of someone's address and life experience and as you can imagen quite personal,

the address is only 20 miles down the road

 

I made contact with the owner of this letter,

he is going to look out incase the letters was switched around and my information is being sent to him,

 

this is what I'm scared about

I rang the hospital where this letter was sent from and they have asked me to fill out a complaint form.

[stu007]

Hi

 

Could you clarify that the NHS letter you received the envelope address window had your Name and Address but when you opened it the contents of the envelope contain this person 20 miles away Medical details with their Name & Address, Hospital CHI Number as well as some of your details?

 

If above correct this is a breach of Medical Confidentiality and a Data Protection Breach by the NHS Trust/Board that Hospital is Under.

 

You need to make a Formal Complaint in writing and get free proof of posting from the post office (ensure to keep copies for your record to the following:

 

1. Hospital concerned to the Data Protection Officer and to the NHS Trust/Board that Hospital is under.

 

2. Information Commissioner Office (ICO) as this is a Data Protection breach: https://ico.org.uk/make-a-complaint/

 

Write to your own GP and inform them of your concerns and enclose a copy of your complaint to the hospital/trust.

 

Inform your local MP of the breach of medical confidentiality & data protection breach.

 

As you have already contacted the other party I would also inform them of the above as they should do the above as well.

 

I am sure other will be along to offer advice

 

[Kallil]

On 04/06/2020 at 01:35, stu007 said:

Hi

 

Could you clarify that the NHS letter you received the envelope address window had your Name and Address but when you opened it the contents of the envelope contain this person 20 miles away Medical details with their Name & Address, Hospital CHI Number as well as some of your details?

 

If above correct this is a breach of Medical Confidentiality and a Data Protection Breach by the NHS Trust/Board that Hospital is Under.

 

You need to make a Formal Complaint in writing and get free proof of posting from the post office (ensure to keep copies for your record to the following:

 

1. Hospital concerned to the Data Protection Officer and to the NHS Trust/Board that Hospital is under.

 

2. Information Commissioner Office (ICO) as this is a Data Protection breach: https://ico.org.uk/make-a-complaint/

 

Write to your own GP and inform them of your concerns and enclose a copy of your complaint to the hospital/trust.

 

Inform your local MP of the breach of medical confidentiality & data protection breach.

 

As you have already contacted the other party I would also inform them of the above as they should do the above as well.

 

I am sure other will be along to offer advice

 

Hello, 

 

The letter itself did not have any of my information but it had the other persons full details, address, contact number, date of birth, nhs number, a whole life history of medical and mental health problems including other personal information.

 

It was in a envelope that was hand written on the front with my name and address.

 

Dose that make a difference? 

[Manxman in exile]

As a former NHS manager in a mental health trust... I agree 100% with the actions recommended by stu007.  And I would make especially clear in your letter(s) of complaint that you are extremely concerned about the whereabouts of any confidential letter that was intended to be sent to you in the handwritten envelope.  (Indeed, the fact that a handwritten envelope addressed to you was used would suggest to me that they definitely had something to send you.  It also sounds a bit odd to me that the envelope was handwritten).

 

As well as complaining in writing to them, I'd contact the clinical team by 'phone first thing on Monday, explain what's happened and tell them to ensure that any confidential information about you that has been sent to a third party must be recovered immediately, and you want confirmation of that.  Well that's what I'd do - see if others think it a good idea or not.  If that had happened at my trust, heads would roll.

 

There's another poster on these boards called "think about it".  They're involved (I think) in GP practice management and may have some comments too about patient confidentiality.

 

Oh - I think I would include a photocopy of the handwritten envelope in my complaint to the trust and the ICO.

 

(I've got to ask - can you say what trust it is?  Don't say if you don't want to.)

 

EDIT:  And well done for contacting the other person to tell them what's happened.  You did the right thing

Edited June 6, 2020 by Manxman in exile

[Kallil]

23 hours ago, Manxman in exile said:

As a former NHS manager in a mental health trust... I agree 100% with the actions recommended by stu007.  And I would make especially clear in your letter(s) of complaint that you are extremely concerned about the whereabouts of any confidential letter that was intended to be sent to you in the handwritten envelope.  (Indeed, the fact that a handwritten envelope addressed to you was used would suggest to me that they definitely had something to send you.  It also sounds a bit odd to me that the envelope was handwritten).

 

As well as complaining in writing to them, I'd contact the clinical team by 'phone first thing on Monday, explain what's happened and tell them to ensure that any confidential information about you that has been sent to a third party must be recovered immediately, and you want confirmation of that.  Well that's what I'd do - see if others think it a good idea or not.  If that had happened at my trust, heads would roll.

 

There's another poster on these boards called "think about it".  They're involved (I think) in GP practice management and may have some comments too about patient confidentiality.

 

Oh - I think I would include a photocopy of the handwritten envelope in my complaint to the trust and the ICO.

 

(I've got to ask - can you say what trust it is?  Don't say if you don't want to.)

 

EDIT:  And well done for contacting the other person to tell them what's happened.  You did the right thing

Hello,

 

Thank you for the advice you have given me, the letter is not from my area but there address is

 

north and west oxon Adult mental health team

the elms centre

oxford road

banbury

oxfordshire

OX16 9AL

 

I have attached a letter they have sent out to me aswell

oxfordmental.pdf

[Manxman in exile]

Oh.  Are you saying the letter sent to you (but intended for somebody else) was from a NHS trust that is not in your area and that you've not had previous contact with?

 

If that is the case, where would somebody at the trust have got your address from to put on the envelope?  And why?  Are you sure the handwritten envelope came directly from the trust?  It all seems very odd to me...

 

Follow whatever formal complaints procedure it says on that leaflet.  Personally, I'd avoid involvement with PALS if I could.  This is too serious for them to deal with.  Still complain to ICO and your MP as well, as suggested by stu007

[Manxman in exile]

Looking at their website they seem to give no option but to complain through PALS - a waste of time in my view.  If I were you I'd complain direct to Kerry Rogers, Director of Corporate Affairs and Trust Secretary.  Head your letter something like "Complaint about breach of patient confidentiality".

 

https://www.oxfordhealth.nhs.uk/about-us/governance/

 

Let the person who the letter was intended for know how to complain too - it was their confidentiality that was actually breached.

[stu007]

I have to agree you need to follow my advice given in post#2.

 

As for PALS as this is a Breach of not only Medical Confidentiality and a Data Protection this will be out a PALS remit and all they will try to do is make lite of this to get you to go away.

 

The PDF you have posted up the hand written comment says it all as to how serious they are not treating this and are basically passing the buck.

 

Please remember it is better if both parties to this yourself and the other party 20 miles away does as stated in post#2.

 

Mr Stuart Bell CBE
Chief Executive
Oxford Health
NHS Foundation Trust
Warneford Hospital
Warneford Lane
Headington
Oxford
OX3 7JX

 

(The above address is that NHS Trust Headquarters)

 

This link is for the Board of Directors of that Trust:

https://www.oxfordhealth.nhs.uk/about-us/governance/

 

This link is for that Trusts Headquarters Address:

https://www.oxfordhealth.nhs.uk/contacts/hq/

 

So as I have posted above I would be writing direct to that Chief Executive

 

Ensure to Title your letter:

 

Formal Complaint - Breach of Medical Confidentiality & Data Protection

[Kallil]

Hi all, and thank you all for your advice, I'm from oxford and I've attended the warnford previously to the outpatients department, but I have never been to the one listed above in banbury, maybe theres a link between the two hospitals, I think the warnford could be the main hospital so this is how the mistake could of happend.

 

I have sent my doctor a letter and a letter to the warnford main reception, they have just directed me to pals, but at some point today I am going to forward these letters to the above people you have mentioned including my mp, 

 

On the part of hand written letters I always recieve this when It is from the warnford, all the other mayjor hospitals like the jr, churchill have windows and my address printed on the the actual letter, I have made contact with the person who owns the letter and I am going to sent him the link to this post so that he can see the information you have provided

 

Thanks again

 

[think about it]

You’ve had some excellent advice from the other posters, it does indeed sound like a data breach that ICO should be aware of. 
 

I experienced something similar when managing a practice where someone’s information was mistakenly included in a letter sent to the police. Thankfully as it had passed from one authority to another the person involved wasn’t adversely affected. Nevertheless the matter was investigated, reported to the ICO and measures put in place to minimise the chance of a reoccurrence. I also contacted the individual concerned to explain what had happened. 
 

From an investigation standpoint I’d be curious about the envelope and whether or not it was franked or had a stamp, I’d want to see the handwriting to compare it to that of my colleagues and also look at checking the audit trails of the clinical systems that hold these letters to see where and when it was printed and by whom. I’d be interested to see if the information was signed as an original copy or a photocopy/print off from a scanned original. 
 

The lack of a properly addressed envelope kind of steers this away from being an administration error in a hospital setting to either a report that’s been stuffed into the wrong envelope on a pile of outgoing mail or someone with adverse intentions. 
 

Please do contact the high level complaints team via PALS, engage with your GP practice manager too although the team at the hospital should automatically involve them and ask them to conduct an internal investigation, I’m sure the PM would appreciate the ‘heads-up’. 
 

It’s entirely possible that you will not get a definitive answer as to what happened and please be reassured that this doesn’t mean there’s some sort of weird stuff happening, just that they can’t identify the source of the breach. 

[Manxman in exile]

think about it is right that it warrants investigation by the trust.  As I've posted before, I'd be inclined to leave PALS out of the loop as I'd be very surprised if they were equipped to deal with this issue - I think you might get fobbed off if you go via PALS.  I'd be complaining direct* to the Trust Secretary and/or Chief Exec (as stu007 suggests) asking them to look into this data breach.

 

*Of course they might just refer you back to PALS!  Which would clearly demonstrate what a crap trust they are...

[stu007]

Hi 

 

The letter sent to the hospital main reception I am afraid will more than likely be passed to PALS and as I have previously stated as this is a Breach of Medical Confidentiality & Data Protection it will be outwith their remit.

 

PALS is setup to look as if they are their to help and assist patients but in reality they are their to protect the NHS.

 

Again please follow my advice given in post#2

[Kallil]

The Chief Exec is about to retier so it will probably be left on the side, I have contacted my local mp, my doctor and the mental health team, no reply from my mp but the doctors and mental health team have referred me to pals, I wont let it be sided and left alone, I feel so sorry for the person who's letter it was, I will be taking up all your advice and contacting everyone who has been mentioned but I dont think it will go far to them it's just a letter and a mistake, we I'll keep you all up dated on the outcome !!

 

thanks again everyone 

[Manxman in exile]

Regarding the hospital trust itself, complain to both the Chief Exec and the Trust Secretary as in the link I gave earlier.  If the Chief Exec is retiring, that's irrelevant.  Just because they are going (or have gone) doesn't mean there isn't somebody else doing their job - it's quite common for the Director of Finance or the Medical director or one of the other executive directors to stand in as Acting Chief Exec until a substantive appointment.  Your complaint will not be left to one side just because of a retirement.  The trust still needs to be run.

 

I shouldn't say this as a former NHS manager, but stu007 is 100% right - PALS are there to act as a buffer between patients and trust management so that management don't waste their time on dealing with complaints like "where do I park my car?", "why is the choice of food so bad?" etc etc.  Yours is a serious complaint and needs to be addressed by senior management immediately.  Ignore anyone telling you to go through PALS.  (Personally, I would ban trusts from referring to PALS in their formal complaints procedures - it's not right).

 

I know stu007 has told you to complain to the Chief Exec and I'm telling you to complain to the Trust Secretary.  Complain direct to both, by name, according to the link I gave above.  I'm suggesting the Trust Secretary because I'm 95% sure that responsibility at board level for data protection and confidentiality issues will rest with her.  stu007 says chief exec because he/she is ultimately accountable for everything that goes wrong.  No harm complaining to both.

 

From think about its post, I would say they think it's a serious breach too - and it is.

 

EDIT:  Put the complaints in writing, to both people, addressed by name and title (eg Kerry Rogers, Trust Secretary, etc etc).  Use the address(es) on the "governance" links given above by me and stu.

Edited June 13, 2020 by Manxman in exile

[Manxman in exile]

I don't want to appear anti-PALS, but the thread linked below demonstrates their limitations.  It's about a hospital parking charge and you'll see that PALS are first mentioned at about #13 and then send a reply to the OP (see #18) which is just wrong and shows they don't properly understand what the complaint is about.  Funnily enough, the OP couldn't get any reasonable resolution out of the NHS trust management until they complained to their MP!

 

PALS can be quite good at dealing with simple issues they understand, but they won't have the authority, the skills or the knowledge required to deal correctly with data protection complaints.  (I was surprised they couldn't even sort out this complaint...)

 

 

[Kallil]

Here's the envelope that the letter come to, I have complained to everyone listed I will keep you updated on responses I get thank you all

[think about it]

So it’s an official envelope / franking then. That’s a good thing in some respects as the source of the letter is narrowed down significantly. The clinic manager may well be able to identify the sender by their handwriting as the pool of likely people will be quite small. 
 

I wouldn’t get too hung up about the upcoming change in exec, there’s no way on earth the existing or incoming exec would investigate this personally, it’ll go to their exec level complaints team/person and be dealt with by them. If every complaint written to the exec was investigated by the post holder they’d never have time to do their actual job. 

[Keli]

I am the carer of the other party involved and this letter contained deeply personal information causing great distress . I will be following all the advice above . Thanku so much to the poster for contacting us . When we went to the elms about our complaint they just kept saying sorry and they wanted to learn from this what’s gone wrong and they would be further investigating and contacting us again , we have not heard from them since . It Is absolutely disgusting the way the other party has been left with no answer or support . 

[think about it]

What’s important to remember here is that besides an apology and putting things into place to minimise the likelihood of it happening again there’s not much else that they can realistically do. If someone feels they need support then it’s important that they ask for it and make their expectations clear about what they need. It’s entirely possible that there will be/have been disciplinary actions taken but it’s not for the response to the complaint to specify what happened and to whom. 
 

 

[ericsbrother]

Unfortunately it is quite an easy error to make as the computer system allows the user to open serveral patient info windows  and if they accidentally click onthe edge of one of the slightly hiddeen window/tabs it can add the data contained to the end of the file that was on top. You get a flashing red background to the window or line of data that is being changed but if someone is busy doing 3 things at once it isnt always obvious. This can add a photograph, change an address or if you are very unlucky record the patient as deceased ( you get more than one warning when this was the intended action).

The unit sending out the letters will have to investigate and self report so worth a follow up to ensure that they have done the latter as well as correcting their now corrupted data.

 

There is another simple error that could apply, they shoved the letter in the wrong envelope that was prewritten for another patient. This should lead to both letters arriving at the wrong address though