Surrey and Borders have not yet answered a complaint made 4 months ago despite promising to only take 3 months!
My partner informed me few months ago that Dr Andrew Iles (psychiatrist) whilst treating me as a private patient used his Surrey and Borders NHS Trust email account to send an email to Dr Hirul Patel of NHFT. He used the Surrey NHS email but did not password protect it in any way and he actually used my name and D.O.B in the title of the Email!
I contacted NHS Digital services who explained Dr Iles used an NHS email and therefore had the capacity to fade out details etc and pointed me to the NHS Confidentiality document which they abide by:
‘It is not permitted to include confidential or sensitive information in the body of an email. When e-mailing to addresses other than the secure domains described above the information must be sent as an encrypted attachment with a strong password communicated through a different channel or agreed in advance.
When communicating via the secure domains, to protect against the risk of accidentally sending to an incorrect recipient, the data should be sent in a password protected attachment, again with the password communicated through a different channel or agreed in advance.’
If its not permitted to include confidential details in the body of an NHS to NHS email (which Iles did anyway) it is certainly not permitted to simply plonk my identifiable details in the title!
Dr Patel then forwarded the email and removed all my identifiable details replacing my name and D.O.B with my NHS number and removed my son's identifiable details from Iles' email also before forwarding it on. Other emails within NHFT about me only reference me by my NHS number which further shows what Iles did was not correct.
Iles had also attached several letters to his to email to Dr Patel also - simply as bog standard email attachments - one letter was simply a response to my complaint and had NOTHING to do with my healthcare! He asked Dr Patel in the body of the email, which also contained all confidential and sensitive information about me, to tell him if he had received the email and all the attachments.
We submitted a complaint about this which Surrey acknowledged receipt of on 21st December 2019. One month later we had an email from their DPO asking to clarify further details and Surrey then said they needed an extra 14 days. They gave themselves till the end of March. Guess what - still no answer (18/04/2020). I know the current situation doesn't help but they didn't bother asking anything until a month after they got it anyway and February business was as usual and they missed their deadline even then. I note that Surrey have a legal obligation to respond to a 'Right to Erasure' request which they have missed by 2 months also.
I'm now going through PALS to get anywhere.
Surrey are clearly 365 24/7 in slo-mo.
Comments