A practice in the City of Leicester area

3. Miss F complains the Practice shared her data without her consent, specifically complaining staff:

• disclosed data to a third party that she did not give consent to share • did not acknowledge or reply to her emails or action her requests • did not accept responsibility for their actions.

4. Miss F said that she has been impacted with emotional distress as these records were very personal and contained sensitive information that she wanted to keep private. She said the disclosure of her data has made her feel worried and that it is an invasion of her privacy. Miss F said she did not want this information out and this has caused her great anxiety knowing that her personal information has been disclosed and cannot be retrieved.

5. As an outcome, Miss F would like the Practice to accept responsibility for what it has done and to issue her an apology.

6. Miss F was in a car accident, and her legal representatives did an assessment where a third party required Miss F’s medical records from the Practice. Miss F’s legal representatives sent over a contract requesting her medical records on 12 December 2024. Miss F emailed the Practice on 9 December 2024, before the contract was sent, instructing the Practice she only gives her consent to the release of certain records.

7. The Practice did not respond to Miss F. She tried to call the Practice on 12 December 2024 and 19 December 2024 but could not get through. Miss F sent a follow up email on 31 December 2024 about her initial email she sent on 9 December 2024. The Practice did not respond. The Practice did not action Miss F’s request and shared all her medical records with her legal representatives.

9. Miss F’s complaint concerns the Practice sharing her confidential medical records without her consent, in part because it missed her emails about what she consented for the Practice to share. This happened during the course of a personal injury claim. We can see all aspects of her complaint relate to what the Practice shared with her legal representatives.

10. We can see the ICO looked at Miss F’s complaint and determined the Practice acknowledged and remedied the error she described in sharing her records. We can see the ICO did not go as far as making an adverse finding of a data breach at the Practice. It did explain it saw the Practice took measures to improve its data handling practices.

11. We can see the GP Practice has provided the remedies Miss F is seeking such as an apology and service improvements. On this basis, and given the ICO has already considered her concerns, we cannot see there is more we can achieve for Miss F. For this reason, we do not consider it proportionate for us to do anything further on her complaint.

12. We thank Miss F for bringing her complaint to us and appreciate the time and effort she has taken to explain her concerns. We recognise the distress this situation has caused her, and she is likely to find our decision disappointing.

13. We hope we have provided clarity about our role and clearly explained how we reached our decision.

1. We have carefully considered Miss F’s complaint about the Practice. We are sorry to hear about the very difficult time Miss F has clearly experienced as a result of the Practice sharing her private medical records. We would like to thank Miss F for sharing the details of her concerns. We know this has been distressing for her.

2. We thank Miss F for bringing her complaint to us. After reviewing the complaint and the information provided, we have decided not to take her complaint further. We saw the Information Commissioner’s Office (ICO) has thoroughly considered Miss F’s concerns. We do not see there is more we can achieve for her. On this basis, we do not consider it proportionate to look at her case further. We explain our reasoning below.