by The confidentiality of NHS medical records has come into question after a ‘stalker’ hospital doctor accessed and shared highly sensitive information about a woman who began seeing her ex-boyfriend despite not being involved in her care.
The victim was left in “fear, shock and horror” when she found out that a doctor had used her hospital’s medical records system to review the woman’s medical records and read – and share – intimate details known only to a few people about her and her children .
“I felt violated when I found out that this woman, whom I did not know, on numerous occasions gained access to details of my life that I shared with my GP and only with family and closest friends. It was about something delicate about me and my children, a family tragedy,” the woman said.
The case prompted warnings that any doctor in England could abuse their privileged access to private medical records for personal rather than clinical reasons.
Sam Smith of the medical data privacy advocacy group MedConfidential said: “This is a completely horrific case. It’s an individual problem that the doctor did it. But it is a systemic problem that they could do this, and flaws in the way NHS data management systems work mean any doctor could do this to any patient.
“If you’re registered with the NHS in England, this could happen to you.”
The Guardian chose not to name either the victim or the doctor who is a consultant at Addenbrooke Hospital in Cambridge.
The woman was initially amazed at how the medic obtained very personal information about her, her sister and her children, which the doctor then passed on to her ex-boyfriend in the early stages of his new relationship with the woman last July.
“The doctor said she got it from friends, people in her choir or parents at my children’s school. This made my sister and I wonder if some of our close friends had betrayed us, as we knew only a few people knew these details. She showed an unhealthy interest in us.
The mystery was solved when, at her request, Addenbrooke’s gave the woman a detailed audit of all its employees who had access to her medical records. It turned out that the doctor had access to her medical records seven times in August and September last year. On three occasions, the medic gained access to Epic, Addenbrooke’s own hospital medical record system, for the first time.
She then clicked on another record system called GP Connect, which contained detailed notes of conversations her ex-partner’s new girlfriend had with her GP about the painful effects of the tragedy and the health of one of her children.
On one occasion, a doctor whom the woman did not know and had never met called the victim, asked her name, gave her name, and hung up. The victim assumed that this was a deliberate ploy by the medic to show that he had obtained personal information about her. “It’s normal to be jealous when your ex is dating someone, but the doctor’s behavior was annoying.”
Addenbrooke initially denied that its employees could access GP Connect through Epic. However, the victim showed Dr. John Firth, deputy medical director, and Michelle Ellerbeck, head of information management, how easy it was to do. Ellerbeck later emailed the woman to thank her for showing them in case “that query ever comes up again.”
Dr Nicola Byrne, NHS England’s national data keeper, advises on how to keep patient information safe and use it properly. She said she was “concerned by the seriousness of the allegations” when a patient wrote to her detailing the unwarranted interference with her medical history.
Byrne criticized the doctor’s behavior as “absolutely unacceptable” and sought to reassure patients who might be concerned about the incident, stressing that this was the first time she had heard of a doctor breaking the rules of safe handling of a patient’s medical records in order to gather information about them. However, it left open the possibility that others might be doing the same.
“A breach of confidentiality is absolutely unacceptable. All clinicians should take their professional responsibilities very seriously. And considering that there is no such case [this] ever caught my attention, I trust most did,” Byrne said.