A surgery has apologised to angry and worried parents who received letters giving details of other people’s children.
Up to 200 consent forms included in letters sent out by Melton’s Latham House Medical Practice, offering children aged two, three and four a flu vaccination, gave the name, date of birth, full address, registered GP and EMIS number of someone else’s child. This reference number is used to access the practice’s clinical system.
Mums took to Facebook to vent their anger over the mix-up as well as complaining to Latham House, with some also vowing to report the matter to other authorities.
Mum-of-five Kim Hendy, of Drummond Walk, fortunately knew the parent whose daughter’s details were on the letter she received for her three-year-old son, Harrison Hall.
But she doesn’t know who has received the consent form with her son’s details on it.
She said: “This is a highly serious matter which needs investigating. There’s quite a few people who have been affected and there are a lot of patients like me who are angry and worrying about who has their child’s details.”
Another angry Melton mum who also received a wrong consent form was Sam George Talbot who said she’d sent a letter of complaint to the practice. She said: “I’m really angry and very concerned. This is a serious data protection issue. I’ve found out who received my child’s data but I’m just in disbelief this kind of information was sent to complete strangers.
“It’s important that everyone affected puts their concerns in writing to Latham House. I’m sure it was down to simple human error but checks need to be put in place to make sure it doesn’t happen again.”
The consent forms giving the wrong child’s details were sent to parents and guardians of children born between September 1, 2010 and September 1, 2013.
Practice manager Alison Hipkin said two batches of letters were affected by the administrative error, with apology letters being sent out to 200 people - whether they’d been affected or not.
She also assured patients that having an EMIS number wasn’t like ‘a magic key’ which could be used to access someone’s complete medical records.
Those who have received the wrong consent forms are being asked to destroy them or bring them back into the practice.
A statement from the practice said: “It was bought to our attention on Monday that an administrative error occurred while sending out flu immunisation letters to a few households in Melton.
“While the letters went out to the correct patients, we’ve since been informed the consent forms, in some instances, have been attached to the wrong letters.
“This has been fully investigated and reported to the correct authorities. The staff members have been informed of the error and all appropriate actions have been taken by the practice to prevent a repeat of this incident.
“The breach of confidentiality is regarding the child’s name, address and date of birth. No medical information has been disclosed.
“Any breach of data security will always be taken seriously by the practice and we’ve mailed out apology letters to patients who might have been affected by this administrative error.”
The East Leicestershire and Rutland Clinical Commissioning Group, which oversees GP practices, has echoed the advice issued by Latham House to affected parents.
A spokesman said: “Latham House Medical Practice contacted us as soon as they realised the error and outlined the actions they were going to take to investigate how this occurred. They also informed us that they had apologised to all parents and carers that had contacted them and would be contacting everyone who received a letter.
“We would also ask anyone who received the letter to check the enclosed consent form. If the name on this is not their child, we are asking them destroy the form or return it to the practice.”
The body responsible to investigating serious data breaches is the Information Commissioner’s Office (ICO). It is the UK’s independent body set up to uphold information rights.
A spokesman for the ICO confirmed it had hadn’t received any complaints about Latham House. The spokesman added: “If people feel their information has not been processed in line with the law, they should take this up with the organisation in question. If they are not satisfied with the response they receive, they can contact us.”