MDU advice

The MDU adviser agreed that the data breach needed to be reported to the ICO and also advised that the patient should be notified.

The adviser explained that the UK GDPR imposes a duty to report personal data breaches to the ICO within 72 hours of becoming aware of the breach, where feasible. The MDU adviser explained that general practices in England can report a breach using the NHS Digital Data Protection and Security Toolkit. In Scotland, Wales and Northern Ireland GP practices would report a breach using the ICO website.

The GDPR also states that if the breach is likely to result in a "high risk" of adversely affecting an individual's rights and freedoms, there is an additional requirement to inform the individual without undue delay.

The ICO website states that when a breach involves health data, it should be considered likely to represent a high risk to the rights and freedoms of individuals. Being open and honest about the incident with the patient would also be consistent with the GMC guidance on the professional duty of candour.

The MDU adviser and the practice manager discussed the need to notify the patient promptly and provide an apology and full explanation. The practice manager could do this by phone, or in writing, and it would be important to be clear what information had been disclosed, the circumstances leading to the breach occurring and being recognised, and what steps the practice had taken since.

The MDU adviser suggested that it was often helpful to offer a meeting to discuss things in person, along with the practice data protection officer (DPO), and to assure the patient that the matter had been investigated and reported to the ICO.

The adviser said that while it is the MDU's experience that a prompt apology and explanation about what has happened is often appreciated and well received, the data breach might lead to a formal complaint from the patient. If this were to happen, then the MDU could help the practice provide a response.

Mistaken identity

Mistaken identity ad 1

Mistaken identity