This blog post contains wording about suicide that some people may find triggering. If your need is urgent, please call 999, (UK) . If you need support, please call 111, (option 2) or call The Samaritans, freephone helpline;116 123.

---

Introduction

The Falsifying of my Medical Records #2, follows on from my previous post, in which I recounted five serious incidents where my GP practice amended, deleted, falsified and omitted data from my medical records. They amended one record 18 months after the date that they made the initial entry, without being transparent about why. The GP practice has deleted one record, which documented me attending Accident & Emergency, (A&E) for suicidal thoughts, and a GP partner, who has never met or spoken to me, falsely recorded that she did two ‘interim depression reviews’ with me. They also deleted and then re-entered a record six weeks after they first entered the record, and did not record that I called 111 for suicidal thoughts.

This post discusses the falsifying of my medical records within the context of The Data Protection Act, 2018, and Article 5 of The UK General Data Protection Regulation, (GDPR,) which ‘makes provision about the Information Commissioner.’[1] This post also examines these incidents within the framework of the ‘False and Misleading Information offence,’ (FOMI.) It calls for urgent legal assistance, to help me out of this perilous situation.

 The Data Protection Act 2018

The Data Protection Act 2018 controls how your personal information is used by organisations, businesses or the government. It is the UK’s implementation of the General Data Protection Regulation (GDPR). Everyone responsible for using personal data has to follow strict rules called ‘data protection principles.’ They must make sure the information is:

• used fairly, lawfully and transparently
• used for specified, explicit purposes
• used in a way that is adequate, relevant and limited to only what is necessary
• accurate
• handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage. [2]

The Data Protection Principles

Relevant to the falsifying of my medical records, Article 5 of the UK GDPR requires that personal data be;

(a)Processed lawfully, fairly and in a transparent manner in relation to individuals (‘lawfulness, fairness and transparency.’)

(b)Collected for specific, explicit and legitimate purposes. (‘Purpose limitation.’)

(d)Accurate and kept up to date. (‘Accuracy.’)

(f)Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. (‘Integrity’ & ‘Accountability.’) [3]

Article 5 (2) adds that; The controller shall be responsible for, and be able to demonstrate compliance with these principles. Article 83(5)(a) states that infringements of the basic principles for processing personal data are subject to the highest tier of administrative fines. [4]

A Closer Look at The GDPR Principles

 (a): Lawfulness, fairness and transparency means that the controller of data and information;

• must ensure that you do not do anything with the data in breach of any other laws.
• must use personal data in a way that is fair. This means you must not process the data in a way that is unduly detrimental, unexpected or misleading to the individuals concerned.
• must be clear, open and honest with people about how you will use their personal data. [5]

 (d): Accuracy;

• Take all reasonable steps to ensure the personal data you hold is not incorrect or misleading as to any matter of fact.
• If you discover that personal data is incorrect or misleading, you must take reasonable steps to correct or erase it as soon as possible.
• You must carefully consider any challenges to the accuracy of personal data. [6]

 (f): Integrity and Confidentiality, security;

This principle states that the controller; must ensure have appropriate security measures in place to protect the personal data you hold.[7]

Accountability;

The accountability principle requires the controller to take responsibility for what you do with personal data and how you comply with the other principles. You must have appropriate measures and records in place to be able to demonstrate your compliance. [8]

Data Protection- Criminal Offences

The information that is available on The Crown Prosecution Service’ website, shows that it is a criminal offence to destroy or falsify information, (section 148) and to ‘re-identify’ data that has been ‘de-identified,’ (section 171.) Under Section 148 (2) (a) it is an offence for a person to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material.[9]

Section 171 is a new offence- it criminalises the re-identification of personal data that has been ‘de-identified’ (de-identification being a process-such as redactions-to remove/conceal personal data). Section (5) states that it is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified. Sections (3) and (4) set out the defences to section 171 (1) – for example, the re-identification was necessary for the purposes of preventing or detecting crime. [10]

Reflection

My GP practice has broken the law by falsifying my medical records. They have breached 3 principles of Article 5 of GDPR. They have breached; principle (a) Lawfulness, fairness and transparency, principle (d) accuracy, and principle (f) integrity, confidentiality and accountability. The practice has committed a criminal offence by destroying the entry on my records, which recorded that I went to A&E on May 17^th for suicidal thoughts. They have also not been accurate by not recording that I phoned 111 on 22nd July, 2024.

They have breached the law by falsifying two entries that stated that the GP partner did two depression reviews with me, (section 148; destroying or falsifying information and documents etc.) If the GP practice now ‘re-enact’ the information that they have ‘de-enacted,’ then they are committing another criminal offence, (section 171: Re-identification of de-identified personal data.) Their recent re-identifying of the de-identified data from 10th June is a criminal breach of section 171. They should not have re-entered the first entry from 10th June that they deleted.

The Rights of Data Subjects

I am alarmed about the falsifying of my medical records. I am particularly concerned about the data that the GP practice has omitted from my records. Due to the number of NHS bodies involved in this cover-up, I don’t feel able to challenge the GP practice myself about their conduct. I need legal help. However, I am comforted to know that the GDPR provides data subjects; 1) the right to object, 2) the right to restrict processing and 3) the right to rectification. I should, therefore, be able to my records put right. I would hope to be able to get the falsified entries removed and the deleted record, which documented me attending A&E on May 17^th, 2024 for suicidal thoughts, put back onto my records, (rectified.) [11]

The False or Misleading Information Offence, (FOMI.)

Following the Mid-Staffordshire inquiry, when Mid Staffordshire Hospitals tried to hide that there were problems, it became part of The Care Bill that it was a crime for Health and Social Care providers to publish false or misleading information. The Care Act, 2014 ‘put in place a new criminal offence applicable to care providers who supply or publish information that is false or misleading, where that information is required to comply with legal obligation,’ (1.) This was part of the coalition government’s drive to improve openness and transparency in the provision of health services. The offence is in two parts; 1) It is a ‘strict liability offence where a provider is found to have published or provided false or misleading information, and 2) where a ‘director or senior official are found to be culpable in the offence,’ (6.) [12]

To be clear, re the definitions of false and misleading. ‘False information is that which can be demonstrably proved to be incorrect’ (11.) ‘Misleading information is presented in such a way, that the meaning is distorted. The information must mislead the intended audience in some way,’ (12.)[13]

Who Does FOMI Offence Apply to?

The False or Misleading Information Offence: Guidance for Providers states that; (14) The offence can be committed by a “care provider of a specific description.” “Care Provider” means a public body which provides health services or adult social care in England. Fact Sheet 14 states that; ‘initially regulations will limit the criminal offence to providers of NHS secondary care.’[14]However, clause (522) of The Care Act 2014- Explanatory Notes- False and Misleading Information, states that; ‘The offence thus applies to public bodies that provide health services or adult social care in England, such as NHS Trusts, NHS Foundation Trusts and local authorities; and to all types of GP practice, whether sole practitioners or partnerships (and whether they have entered into personal medical service or general medical service contracts with NHS England,) (522.) [15]

Reflection

Whilst ‘False or Misleading Information,’ (FOMI) applies, in the main to NHS secondary care, General Practitioners, (GP’s) are still expected to adhere to accurate and transparent information practices to maintain patient trust and safety. For a GP to enter onto a patients’ record that she has conducted two depression reviews, when she has never met or spoken to the patient, is false and misleading information. It is false because it is incorrect. It is misleading because it looks like the GP has been giving the patient support, when they have not.

Conclusion

This post has framed the falsifying of my medical records within the context of The Data Protection Act, 2018 and FOMI. My GP practice has breached these laws by deleting data and falsifying entries on my records. I am in a very vulnerable predicament, and feel very afraid. I am not in the hands of safe healthcare providers. This is dangerous misconduct, that is putting me at risk. I need the assistance of a lawyer, who can help me out of this situation. I am also seeking a medical journalist, who can bring my story to the attention of the public eye. If you think you can help, please get in touch by email; info@myfacialpain.com, via my contact page or @myfacialpain on X.

Foot Notes

[1] Data Protection Act, 2018, Part 1, Section 1, www.legislation.gov.uk

[2] Data Protection: The Data Protection Act – GOV.UK (www.gov.uk)

[3] Information Commissioner’s Office; A guide to the Data Protection Principles,  www.ico.org.uk

[4] Information Commissioner’s Office; A Guide to the Data Protection Principles, www.ico.org.uk

[5] Information Commissioner’s Office; Principle (a): Lawfulness, Fairness and Transparency, Data Protection Principles, www.ico.org.uk

[6] Information Commissioner’s Office: Principle (d) Accuracy, Data Protection Principles, www.ico.org.uk

[7] Information Commissioner’s Office: Principle (f) Integrity and Confidentiality (security,) Data Protection Principles, www.ico.org.uk

[8] Information Commissioner’s Office; Principle: Accountability, Data Protection Principles, www.ico.org.uk

[9] The Crown Prosecution Service (CPS); Offences Under the DPA 2018, Data Protection Act 2018 – Criminal Offences, www.cps.gov.uk

[10] The Crown Prosecution Service (CPS); Offences Under the DPA 2018, Data Protection Act 2018 – Criminal Offences, www.cps.gov.uk

[11] GDPR Summary; Data Subject Rights: All You Need to Know, www.gdprsummary.com

[12] Department of Health; The False or Misleading Offence: Guidance for Providers., www.publishing.service.gov.uk

[13] Information quoted from same source as footnote 12.

[14] Department of Health; The Care Bill – False or Misleading Information, December, 2013.

[15] The Care Act 2014 Explanatory Notes, part 2, False or Misleading Information,  www.legislation.gov.uk

Photo Credits; Ferarcosn, RDNE Stock Project and Pixabay on Pexels. Emiliano Vittoriosi and Towfiqu Barbhuiya on Unsplash. Fathromi Ramdlon, Tho-Ge, Niekverlaan, Artsy Solomon, Leroy Skalstad and Bilijana Jovanovic on Piaxabay.