NHS Trust Reprimanded After Delays to Thousands of Referrals

Written by

UK GDPR regulator the Information Commissioner’s Office (ICO) has reprimanded an NHS trust after an IT issue led to many crucial GP referrals going missing.

The data protection infringement was first spotted at Derby’s Florence Nightingale Community Hospital, part of the University Hospitals of Derby and Burton NHS Foundation Trust (UHDB).

UHDB was informed by NHS England as far back as 2019 of an issue with the national digital platform whereby referrals dropped off its worklist after 180 days. If not managed correctly, the information would be lost to the hospital altogether after 550 days, the ICO explained. This appears to have been the case with UHDB.

Although NHS England provided staff with guidance on how to manage drop offs from the worklist using an internally generated report, no special training was provided to UHDB staff as this was considered to be a “routine task,” according to the reprimand.

Read more on NHS reprimands: UK Regulator: HIV Data Protection Must Improve

Some 4768 patients were impacted by the data handling error – 4199 of which had their referrals delayed. The remaining 569 referrals disappeared altogether, with some patients forced to wait for over two years for medical treatment to be provided, the ICO revealed.

Although this represents only a small number of the 1.7 million referrals UHDB processes annually, ICO head of investigations, Natasha Longson, argued that this mishandling of healthcare data caused “unnecessary distress and disruption to patients,” and that the provider should have done better.

“Trusts have a responsibility to their patients, and we cannot see any more mistakes of this kind,” she added. “We are pleased to see the trust has taken remedial steps towards patients impacted, as well as sharing learning throughout the organization to ensure that these mistakes are not repeated.”

Patient referrals from family doctors (GPs) to hospitals are a crucial cog in the NHS machine. The maximum wait time for non-urgent, consultant-led outpatient treatment is set at 18 weeks from the day the appointment is booked.

Image credit: Ink Drop / Shutterstock.com

What’s hot on Infosecurity Magazine?