Lincolnshire Community Health Services NHS Trust

3. Mr and Mrs A complain about the Trust’s actions between 2019 and 2022 saying it:

• wrongly allowed a nurse who knows them and other people around the country to access their records, for non-clinical reasons • did not apply a restriction on Mr A’s records • did not investigate the complaint using the relevant law and it did not use available audits and evidence.

4. Mr and Mrs A say they have been victims of identity theft and fraud. They say people have impersonated Mrs A by booking and attending appointments as her, people have taken loans out in Mr A’s name and their information has been sold on. They say their records have been accessed around the country without their consent and for non-clinical reasons.

5. They want an investigation, for a restriction to be added to Mr A’s records, for the conduct of the nurse to be investigated and compensation for the impact this has had on them.

8. Before we decide if we should do a detailed investigation of a complaint, we look at whether there is an organisation that is better suited to deal with the concerns and to give the outcomes Mr and Mrs A want.

9. Our guidance states:

‘3.1 Some complaints can be looked at by both us and another complaint handler. We would usually consider though, that only one investigation should take place. The caseworker should consider which organisation is more appropriately placed to consider the complaint and achieve the remedy sought. (Policy requirements)’.

10. For the outcomes Mr and Mrs A want, there are a few different organisations that are better suited than us to consider this matter. These are the ICO, NMC and the police.

11. Mr and Mrs A say they have already contacted other organisations who are starting investigations into their complaint. Since they brought their complaint to us, Mr and Mrs A say they have contacted the police who gave them two crime reference numbers. They say their complaint is with Lincolnshire Cyber Investigations Unit, the Digital Investigations Unit and the police are considering if their complaint falls under the Computer Misuse Act.

12. Fraud and identity theft are criminal matters and need input from the police. We cannot look into Trust staff accessing clinical records where it so clearly links with concerns about the misuse of data.

13. We can also see there are clear references to breaches of General Data Protection Regulation (GDPR) by Mr and Mrs A and they are looking for more information on this. We know Mr and Mrs A originally contacted the ICO about this.

14. As Mr and Mrs A believe further consideration of breaches of GDPR are needed, we think they should return to the ICO. The ICO’s website says it can investigate issues about the Data Protection Act (DPA) and GDPR. Although Mr and Mrs A have been to the ICO before, they may consider contacting it again as things have progressed since. The ICO can advise on whether it seems the law has been breached.

15. If Mr and Mrs A want a legal decision on the claimed data breach, they would need to take legal advice.

16. Part of the complaint may also be suitable for the NMC. It is an independent organisation that regulate nurses, midwives and nursing associates. The NMC’s website says it investigates concerns about nurses, midwives and nurse associates, so it would be better suited to dealing with the complaint about the nurse’s conduct.

17. Our legal advice told us that although we may be able to look at the complaint about the Trust’s investigation, it would not be right for us to do this while other organisations are investigating.

18. If there are other outcomes that the police and other organisations cannot look at as part of their investigations and their considerations are complete, Mr and Mrs A can come back to us.

19. If Mr and Mrs A need to come back to us, we encourage them to do this as soon as possible as we have a time limit for looking at complaints.

1. We have carefully considered Mr and Mrs A’s complaint about Lincolnshire Community Health Services NHS Trust (the Trust). We are very sorry to hear of the circumstances that led them to come to us. We understand this complaint is very important to them.

2. We listened to what Mr and Mrs A said about what happened and what they hoped to achieve from making their complaint. It is clear they have very serious concerns about fraud and identity theft and the conduct of Trust employees. We think it is best for the police to look at these criminal allegations. Parts of their concerns may be best dealt with by the Information Commissioner’s Office (the ICO) and the Nursing and Midwifery Council (NMC). We explain in more detail below.