Personal data breach

Hi. I found out that my treating Consultant Psychiatrist who works for an NHS Mental Health Trust breached my confidentiality in 2018 and I made a written complain to the Consultant and asked for copies of the communications she had sent without my knowledge or consent. It transpires the Consultant did not pass my complaint or information request onto the NHS Trust wbere I am a patient and the Trust are trying to argue that as the Consultant did not pass on my complaint to them then it is outside the 12 month time limit and are refusing to investigate it despite me complaining to the Consultant within days of me complaining about the complained about breach of confidentiality having occurred.

A related problem is that the NHS Trust are saying I have to make a request for my medical records in order to be provided with copies of the communications the Consultant sent without my consent or knowledge and this is despite me having made it clear in my letter to the Consultant in 2018 that all I wanted was copies of the communications they had sent to the third party without my knowledge or consent and for which there had been no lawful justification.

Has anyone got an suggestions about what are 2 related issues of the complaint and information request to a Mental Health NHS Trust

Hi Neil

Personal data can be disclosed without consent in some cases. See: Does an organisation need my consent? | ICO

You could consider making a complaint about the doctor to the General Medical Council (GMC). See: However there is a time limit “Complaints should normally be made within 12 months of the event that you’re complaining about, or as soon as the matter first came to your attention. The time limit can sometimes be extended as long as it’s still possible to investigate the complaint.” However the GMC does have a 5 Year rule. Search for “gmc 5 year rule” and see GMC Investigations – Doctor’s Questions Answered - GMC Defence Barristers. This website has a pertinent statement “It is a well-established fact that simply saying sorry is not enough. Insight and remediation must be genuine and demonstrable.”

Look up the doctor on the medical register. You will need the registration number when filling in the complaint form.

It is important to make complaints promptly when you become aware of a problem. The trust should have named the ombudsman that you could take your complaint to if you were not happy with the trust’s response. It would be the Parliamentary and Health Service Ombudsman (PHSO). The ombudsman might be a bit more flexible on time if you have a good reason for the delay but are busy with a high workload.

You do not say whether you have copies of the letters but you should consider getting your records from the trust via a formal Subject Access Request (SAR) via the trust’s website asap. See: How to get your medical records - NHS My understanding is that an informal request should be processed in the same way as a formal SAR. Your doctor may not have understood your rights and could be at fault. Right of access | ICO

When making the SAR you would be able to specify what information you need. Or you could request all the data that they have over a time period. You could also apply to the organisation(s) that received the letters.