Police probe hospital patient privacy breach

AN INVESTIGATION is under way into a breach of patient confidentiality at one of Scotland’s biggest hospitals after a cleaner looked up a young mother’s medical records on a computer and used them to pester her online.

The worker noticed the woman while she was being treated at the hospital’s accident and emergency department after injuring her hand in a fall.

She had no contact with him at the time, but the next day he sent her a message through the social networking site Facebook.

The woman, who has asked not to be named, received five messages in all from the cleaner, who admitted using hospital computers to look up her personal details and track her down online.

She said she was shocked and scared after receiving the messages and has called for an inquiry into how patients’ records are protected at the ERI.

The worker is now understood to have been suspended by Consort, the private company contracted to clean Edinburgh Royal Infirmary, and NHS Lothian has referred the matter to police who are now investigating.

“I was really upset when I read the e-mail,” she said.

“I didn’t know who he was, what he was capable of, or whether he also knew my address and telephone number.

“I didn’t know if he was just going to turn up at the house. It’s just wrong in so many ways.

“I’ve got two boys at home – one aged two, the other six months – so I was worried for them too. I’ve been told by the police I’m not allowed to go out by myself, or go out when it’s dark. It’s really serious.”

He first contacted her last Thursday, the day after she had gone to the hospital’s accident and emergency unit with two broken fingers on her right hand, following a fall.

She received a Facebook friendship request with the accompanying message: “Btw if ur wonderin who i am, i was checkin u out yest :) ha hows the hand?X”

When she asked who he was, he replied: “I work in a&e, random ano lol delete me if u want, just thought u were nice!”

In one e-mail, he admitted finding her name on one of the hospital’s computers.

The woman, who lives in Edinburgh, said: “I went to the hospital because I fell and broke two fingers on my right hand.

“I can remember seeing him cleaning, and my dad, who was with me, remembers him, but I don’t remember him even looking at me, let alone ‘checking me out’.

The family complained to NHS Lothian, which referred the case to Lothian and Borders Police, and also informed Consort, who employed the cleaner.

She then received a final message from him asking her not to take it any further. However, the family is now demanding a full review of security of patient details at the hospital, and have been backed by the Scotland Patients Association, which said it already had concerns about levels of data protection at hospitals.

The woman said: “The hospital should have better data protection measures in place to stop this happening in the first place.

“How was he able to get access to the computer? My family and I will be taking this further.

“There should be more security in place. There should be an inquiry into how they protect patient information.”

The Scotland Patients Association said it already had concerns about confidentiality and wanted to see security levels improved.

Chairwoman Margaret Watt said: “Workers should not have access to patient files. There definitely needs to be more safeguards in place and security over records. We are concerned about confidentiality.”

She added: “We do know that these kinds of things are going on, although we don’t know to what extent.”

She added: “This has hugely overstepped the mark. It means there is no safety if people like this can go and read files.

“Would he have been able to get her home address as well?

“I would hope not, but if it’s her patient file her home address may have been on it.

“I am pleased he has been suspended, that is the right course of action to take. This is a very serious matter.”

NHS Lothian was unable to say how the cleaner accessed the work computer and said that would be part of the ongoing investigation.

Jackie Sansbury, chief operating officer, said: “NHS Lothian takes patient confidentiality extremely seriously.

“An incident involving an employee from an independent contractor was reported and immediate action was taken.

“It has been reported to Lothian and Borders Police, and therefore it would be inappropriate to comment further.”

A spokeswoman for Consort added: “Consort Health Care takes allegation of confidentiality very seriously.

“When an incident involving an employee was reported, immediate action was taken.

“Also, the matter was reported to police; therefore it would be inappropriate to comment further.”

Last month, it emerged that dozens of health staff in the Lothians had been disciplined for breaching confidentiality rules over patient records. One was sacked and received a criminal caution, a second was suspended and others were given final warnings.

The figures were released in a report compiled by civil liberties campaign group Big Brother Watch as a result of freedom of information requests to health boards around the country.

Police confirmed the new allegations, involving the hospital cleaner, were currently under investigation.

A Lothian and Borders spokeswoman said: “We can confirm that a complaint has been received, and we are looking into it.”

A spokesman for the UK Information Commissioner, which oversees data protection in Scotland, said: “It is important hospitals do as much as they can to keep patients’ records secure.

“As this is a police investigation, we cannot comment further.”