Hospital records of Derry domestic violence survivor illegally accessed

A young Derry mother fleeing domestic violence had her hospital records accessed by an unauthorised Western Health and Social Care Trust (WHSCT) staff member.

The woman, who wished to remain anonymous, received written confirmation of the data breach from WHSCT chief executive, Neil Guckian.

In his letter of apology, Mr Guckian confirmed to the woman her records had been unlawfully accessed by a member of her ex-partner’s family - a Trust employee, seeking to ascertain her address. 

Speaking to Derry News, the woman, who was understandably upset, said the “breach of confidentiality and trust has exacerbated the difficulties I face”.

“It has also raised serious concerns about the integrity of the Trust’s operations. I am committed to shedding light on this issue and ensuring others do not suffer similar injustices,” she added.

In his letter of March 24 to the woman, Mr Guckian said there was “evidence” the Trust employee had accessed the Patient Administration System (PAS).

He wrote: “This system allowed [them] access to your address and hospital appointments. There is no evidence that [they] accessed any of your medical information or your laboratory results.

“[Their line manager] met with [them] after receiving this information, and [they] admitted to accessing the Patient Administration System to get your address as [they] wanted to send a present for [their] new grandchild. [They] explained to [their line manager] that you had been in a relationship with [their] son and that you had a baby with him.

“Please be assured the staff member has been spoken to about the incident by senior staff and has been instructed to retake the Trust’s Information Governance Awareness training.

“On behalf of the Western Health and Social Care Trust I wish to support [their line manager] in making this apology to you for any distress you may have suffered as a result of these matters.”

Speaking about her ordeal, the woman said she had made a written complaint about the data breach to the WHSCT in May 2023.

She believed the only reason she got a response was because she had escalated her complaint to the Northern Ireland Public Services Ombudsman (NIPSO), following the Trust’s failure to respond.

The woman revealed her ex-partner had been physically abusive and coercively controlling.

“In 2020, I was six weeks pregnant and we broke up. I tried to facilitate contact. I actually met up with [one of his parents] every month for about two years, before [they] stopped this abruptly,” she said.

“At that time my child was not having any contact with her father because of the last bout of domestic abuse.

“I had the wane in my arms and he pushed me up against the door and just stormed out. Before that he had had contact but it was only ever in my mammy’s house and there was always someone there.

“I had moved house and everything so he wouldn’t know my address. I was terrified of him. In spite of this, his [parent] kept asking where I had moved to but I always kept it very vague.”

The woman said, having received Mr Guckian’s letter, she had decided to appeal the WHSCT’s response to the data breach, in particular the “soft” sanction imposed on the Trust employee who had “illegally” accessed her medical records.

“I had 30 days to lodge an appeal and I have done that,” she said. “I think the WHSCT has handled this matter properly very poorly.

“The scariest bit for me is that someone was trying to find out my address. I am terrified of [their] son finding out where we live because he would have called to my previous address unannounced. I am afraid of him because of his previous behaviour. He has threatened me and the wane in the past.

“For my safety and the safety of the wane, I have actually contacted the Housing Executive to get moved out of this house. I just don’t feel safe in it now.”

A spokesperson for the Western Health and Social Care Trust (Western Trust) said: “Protecting patient confidentiality and privacy is a matter of the utmost importance to us.

“The Trust takes any breach of confidentiality extremely seriously and are fully investigated in line with the Data Protection Act.”

It is very important to note that it was not her medical records that were accessed but the system that will provide her address.