A practice in the City of Leicester area

3. Miss Y complains the Practice shared her data without her consent, specifically complaining staff:

• disclosed data to a third party that she did not give consent to share • did not acknowledge or reply to her emails or action her requests • did not accept responsibility for their actions.

4. Miss Y said that she has been impacted with emotional distress as these records were very personal and contain sensitive information that she wanted to keep private. She said the disclosure of her data has made her feel worried and that it is an invasion of her privacy. Miss Y said she did not want this information out and this has caused her great anxiety knowing that her personal information has been disclosed and cannot be retrieved.

5. As an outcome, Miss Y would like the Practice to accept responsibility for what it has done and to issue her an apology.

6. Miss Y was in a car accident, and her legal representatives did an assessment where a third party required Miss Y’s medical records from the Practice. Miss Y’s legal representatives sent over a contract requesting her medical records on 12 December 2024. Miss Y emailed the Practice on 9 December 2024, before the contract was sent, instructing the Practice she only gives her consent to the release of certain records.

7. The Practice did not respond to Miss Y, and she tried to call them on 12 December 2024 and 19 December 2024 but could not get through. Miss Y sent a follow up email on 31 December 2024 about her initial email she sent on 9 December 2024 but did not get a response. The Practice did not action Miss Y’s request and shared all her medical records with her legal representatives.

10. The law sets out what we have the power to investigate. We can investigate actions organisations take while providing services under the NHS. We cannot investigate commercial transactions of NHS organisations.

11. The complaint concerns the Practice sharing Miss Y’s confidential medical records without her consent, in part because it missed her emails about what she consented for the Practice to share. This happened during the course of a personal injury claim. We can see all aspects of her complaint relate to what the Practice shared with her legal representatives.

12. The Practice provided her records to her legal representatives on provision of a form of authority. This falls outside our power to investigate under the law. This was as a commercial transaction as Miss Y’s legal representatives will likely have paid the Practice an administrative fee for the provision of the records. It was not provided on the basis of providing an NHS service.

13. The Practice processed the legal firm’s request under GDPR/DPA regulations for the purposes of Miss Y’s legal claim. This ordinarily involves a legal firm paying an administrative fee to a GP practice. Therefore, because of the commercial nature of the transaction, we cannot investigate such matters.

14. We thank Miss Y for bringing her complaint to us and appreciate the time and effort she has taken to explain her concerns. We recognise the distress this situation has caused her, and she is likely to find our decision disappointing.

15. We hope we have provided clarity about our role and clearly explained how we reached our decision.

1. We have carefully considered Miss Y’s complaint about the Practice.

2. We thank Miss Y for bringing her complaint to us. After reviewing the complaint and the information provided, we have decided we cannot take her complaint further. This is because we do not have the powers to investigate Miss Y’s complaint. We explain our reasoning below.