{"text_format":"1","workbook":"xlsx","n_sheets":1,"sheets":["export_WOOSHMED GDPR Reporting "],"not_rendered":{"charts":0,"images":0,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"export_WOOSHMED GDPR Reporting ","index":0,"n_rows":20,"n_cols":17,"rows_kept":20,"cut":false,"hidden":false,"merged":[[0,0,2,9]]}
[]
[]
[]
["GDPR_Ref_No","Reported by:","Date Incident discovered","Date Incident Reported","Type of incident","Incident details - State the facts only, where it occurred; what information was   involved; etc.","Number of patients affected","Initial action(s) takenÂ - What did you do?","Initial action(s) takenÂ - Who will/have you reported the incident to?","Current status","GDPR Role & Name of officer responsible for the investigation.","Date incident reported to the DPO","Date of response from the DPO","DPO Rating","DPO findings, recommendations and actions","If yes, state actions taken within the practice","Add any other relevant final notes here, e.g. issue and   outcome discussed at staff meeting] "]
["GDPR00020","Anne Strong","2026-06-12","2026-06-15","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Patient was sent a blood form attached to an Accurx message. Patient SP informed us that she had received a blood form for another patient CW.",2,"Established the identity of the patients affected. Conversation to be held with the staff member who had sent the form out to the patient. \r\n\r\nNew blood form raised. Team to be reminded that they are to open any attachments to ensure that they are sending the correct documentation to the patient.\r\n\r\nReported to management who reported to the Practice IG Lead/SIRO to report to the DPO.","Richard Short","Reported to Management / GDPR Officer","SIRO - Richard Short",null,null,null,null,null," "]
["GDPR00018","Anne Strong","2026-06-15","2026-06-15","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Patient was given a set of stool containers with another patients details on them.",2,"Established the identity of the patients affected. Conversation to be held with the staff member who had put the incorrect labels on the bottles.  Both patients spoken to and explained what had happened - Admin apologised to the patients.\r\n\r\nEmail has been sent out to the team to ensure that they check all patient details when handing out pathology pots.\r\n\r\nReported to management who reported to the Practice IG Lead/SIRO to report to the DPO.","Richard Short","Reported to Management / GDPR Officer","SIRO - Richard Short",null,null,null,null,null," "]
["GDPR00017","Josie Goode","2026-06-02","2026-06-02","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Blood form sent to the wrong patient.  \r\n\r\nAdmin IM&rsquo;d about another patient repeatedly and message typed for previous patient gone to one open.",2,"Informed RS, contacted the patients and apologised to the patient who has received the blood form.  \r\n\r\nPatient who had received the others information advised they have already deleted off the message containing the information","Richard Short","Reported to Management / GDPR Officer","SIRO - Richard Short",null,null,null,null,null," "]
["GDPR00016","Debbie Cleary","2026-05-11","2026-05-11","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Patient requested an SAR due to being informed that their record stated they were taking weight loss injections in June 2025.\r\nThis entry, in the patient&rsquo;s clinical record, pertained to another patient, whose details were included in the entry which therefore constitutes a data breach.",2,"DC (Complaints Manager) reported the event to TJ based on of the SystmConnect request received from the patient. This was then investigated and this wrong information was marked in error on patients record and patient made aware and given apology.  Patient still prefers to have a copy of SARs to check for any further issues.","Tyr-John Baverstock","Reported to Management / GDPR Officer","SIRO - Richard Short","2026-05-12","2026-05-13","Minor","DPO Reference: ML087404\r\n\r\nWhere a breach/suspected breach has been caused by a GP Practice, it is important the Practice take appropriate action in a timely manner to address this by following these steps:\r\n\r\nInvestigate the matter fully, ensuring you adhere to your internal reporting process.\r\nLog the breach and all associated action taken.\r\nIdentify and enact any mitigating actions quickly to reduce the impact of the breach.\r\nInvestigate the root cause of the breach to identify recommendations for change and improvement and help prevent repeat occurrences.\r\nInform your practice Caldicott Guardian and ensure you add to your practice log (you should also have a separate log for breaches, actions taken/ lessons learnt etc which will also need updating). The Caldicott Guardian will advise whether you should inform the data subject(s) and again log this query. You must consider if informing the data subject would cause significant harm, upset or distress although the preference is always to inform as far as possible.\r\nReport the breach on the Data Security and Protection Toolkit (DSPT) &ndash; this link provides useful guidance on how to do this - https://www.dsptoolkit.nhs.uk/Help/29","Highlight the need to make thorough checks when dealing with patient information that staff members ascertain patient details, (using three data checks, e.g.e name, DOB, address) and that they have the correct patient record open when referencing, or saving, information to the record.\r\n\r\nRecord incident on the DSPT toolkit  - Done 48280"," "]
["GDPR00015","Anne Strong","2026-04-20","2026-04-20","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Patient  was sent a blood form attached to an Accurx message. Patient AT called to inform us that she had received a blood form for another patient RH.",2,"Established the identity of the patients affected. Conversation held with the staff member who had sent the form out to the patient.  Admin apologised to the incorrect patient and asked her to delete the message. GPA member called the patient whose data was shared to explain and apologise. Team has again been reminded that they are to open any attachments to ensure that they are sending the correct documentation to the patient.","Richard Short","Reported to Management / GDPR Officer","SIRO - Richard Short",null,null,null,null,null," "]
["GDPR00014","Anne Strong","2026-03-26","2026-03-30","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Patient called surgery to request her blood form.  Reception staff member downloaded the blood form from ICE and attached to an Accurx message and sent out to the patient.  However, the receptionist had another blood form saved in her documents that belonged to another patient and she attached this form to the Accurx message.  Patient RB called to inform us that she had received a blood form for another patient.",2,"Established the identity of the patients affected.  Apologised to the patient and asked her to destroy the incorrect blood request form.  Receptionist will call the patient whose data was shared to explain and apologise.  Admin team have been told that they are not to have pt information stored on their desktop.  They have also been instructed that they are to open any attachments to ensure that they are sending the correct documentation to the patient.","Richard Short","Reported to Management / GDPR Officer","SIRO - Richard Short",null,null,null,null,null,"email sent to all administration staff. "]
["GDPR00013","Anne Strong","2026-02-11","2026-02-12","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Patient received a message about medication that she had never been prescribed.  Called to ask why she had received this message and on investigation it appears that a patient with same name had submitted a SC and this had been incorrectly matched the pt who reported this incident.  No data was shared with the reporter re the correct patient.",2,"Apologised to the patient who reported this.  SC then removed from her record and assigned to the correct patient for action.  Reported to management who reported to the Practice IG Lead/SIRO to report to the DPO.","Richard Short","Reported to Management / GDPR Officer","SIRO - Richard Short","2026-02-12","2026-02-13","Minor","DPO has noted that a medication was disclosed to the individual that was intended for another patient of the same name. DPO would agree that this would be classed as a near-miss incident, but would also advise that further actions are carried out in line with your organisations Caldicott Guardian/Clinical Safety Officer process review.\r\nAll actions taken, recovery of the data, and issued apology for data protection breaches are provided in your email, and attachment as taken place.\r\n\r\nDPO would normally advise that the Data Security &amp; Protection Toolkit (administrator log on only) that provides a &lsquo;Report an incident&rsquo; facility is completed, but in this case it is likely to return a &lsquo;not reportable to ICO&rsquo;, and on this occasion the DPO would be assured that internal incident process has been completed. Unless the practice with your knowledge of the processing of data taking place at the practice, feels that there is a &lsquo;high&rsquo; likelihood of this type of incident to take place in the future, then the DPO would advise that the DSPT &lsquo;Report an incident&rsquo; is completed for record keeping purposes and tracking of events such as these taking place, i.e. support Root Cause Analysis of these types of incidents in the future and how meaningful process review can take place to mitigate them taking place again.\r\n\r\nSummary: no further actions noted by DPO as not taking place for a near-miss data protection breach.",null,"To raise at the next Pharmacy Team, or Clinical meeting the need to be careful when sending /giving things, containing patient data, to patients.     A two, and preferably three, item check, e.g. Name, DOB, address/mobile/landline/email, should be made to ensure the data being sent is going to the correct patient.     Also to raise with admin as well. "]
["GDPR00012","Anne Strong","2026-02-03","2026-02-04","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Patient collected FIT sample from reception &ndash; this was labelled with another patient&rsquo;s demographics (6490109549).  Patient discovered this when he went to provide the sample.  Patient returned the incorrect bottle to the reception team.",2,"Patient was given a new bottle with the  correct demographics.  Reported to management who reported to the Practice IG Lead/SIRO to report to the DPO.","Richard Short","Reported to Management / GDPR Officer","SIRO - Richard Short","2026-02-05","2026-02-05","Minor","The incident should be discussed at the next team meeting to reinforce the importance of checking all patients&#039; details before giving/handing any information.\r\n\r\nIf harm is reported as a direct result of this incident, then it will need to be reported on the Data Security &amp; Protection Toolkit report an incident Report an Incident.  This was done and the incident was assigned the reference number 46447.",null,"Admin staff reminded, at team meeting, to check all documents and labels when handing out to the patients.  All admin staff reminded via email and will be raised at the next Admin Team meeting. "]
["GDPR00011","Anne Strong","2026-01-19","2026-01-19","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Wrong patient details had been entered onto the firearms Licence from.  Form given to the patient and breach discovered when the form was handed into the police",2,"Apologised to pt and pt asked to return the form to the surgery.  New form to be issued.  Breach to be reported to the DPO.  To be raised at the next Clinical Meeting","Debbie Cleary, Ghulam Shabir","Reported to Management / GDPR Officer","SIRO - Richard Short",null,null,null,null,null," "]
["GDPR00006","Lindsay Mackenzie","2025-03-05","2025-10-14","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Mobile phone number given to another patient on an SMS as a contact number for hospital dept.\r\n\r\nThe error was reported by the patient to the practice, as the other patient phoned them.",1,"On a Monday morning in rushing to catch up with many incoming messages I can only imagine that the error happened by my picking up as a copy paste a mobile listed on the line below the one, I intended.\r\n\r\nBoth patients contacted with explanation and apology\r\n\r\nData controller informed","Richard Short","Reported to Management / GDPR Officer","SIRO - Richard Short",null,null,null,null,null," "]
["GDPR00009","Anne Strong","2025-10-08","2025-10-14","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Patient attended ECG on 1st October at ST.  Seen by nurse.  Pt given copy of the ECG report as was attending a hospital appt for Urology procedure on 2nd October.  On attending the hospital appointment, pt was advised by the Anaesthetist that he had another patient&rsquo;s ECG report.",1,"Pt sent letter of complaint into the practice dated 8th October 2025.  \r\n\r\nResults of the ECG on pt record (incorrect pt) were also reviewed by on-call GP.\r\n\r\nPt complaint also raised","Richard Short","Reported to Management / GDPR Officer","SIRO - Richard Short","2026-01-07","2026-01-07","Minor","The DPO recommends\r\n\r\n&bull;\tThe practice should ensure the ECG documents are recorded on the correct patient records.\r\n&bull;\tConsider the duty of candour, ensuring further harm is not caused by informing the other incorrect patient involved\r\n&bull;\tThe incident will need to be scored, and if the incident is classed as causing harm to the affected patient/s as a direct result of the incorrect disclosure, then the incident will need to be reported on the Data Security &amp; Protection Toolkit/ report an incident. I have attached the guide for the notification of data security and protection incidents to assist you in this scoring.  \r\n&bull;\tThe practice needs to review the process for checking all patient information before release\r\n&bull;\tDiscuss the incident at the practices team meeting to reinforce the importance of keeping all confidential information secure, including the checking of all documents before release  \r\n&bull;\tEnsure that all staff can recognise data breaches and know the importance of reporting the incidents in a timely fashion. UK GDPR guidance states the organisation has 72 hours to report an incident to the supervisory authority (Information Commissioner&#039;s Office) once discovered.  Late reporting can incur a fine.","See above"," "]
["GDPR00008","Neelam Kanzaria","2025-03-28","2025-03-28","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","A patient was sent an SMS message with another patient&rsquo;s blood form which included personal details and requested blood test details.",2,"Apologised to patient who received the incorrect form and sent the blood test form to the correct patient.","Richard Short","Response received from DPO","SIRO - Richard Short","2025-04-02","2025-04-02","Minor","This is a low-level breach as the disclosure was contained and controlled and both patients should be informed of the error, using the Guide to the Notification of Data Security and Protection Incidents, Reporting incidents post the adoption of GDPR 25 May and NIS Directive 10 May 2018 (updated September 2018) as a guide, do a local Incident report, and manage locally - suggest lessons learnt are reminding staff (via email to all) of the importance of checking the patient details and letters/forms/emails and SMS messaging before sending.&nbsp;&nbsp;","Staff to be reminded when sending out forms/paperwork to patients via email or SMS to ensure that they are opened and checked before sending."," "]
["GDPR00010","Hetul Shah","2025-07-11","2025-07-25","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","I accidenatally attached blood test forms for 2 different patients to a third patient when texting them.  It was hman error. The receiving patient messaged us back and I called her to apologise and find out what had happened. She said it was not a probelm for her and she assured me she would destroy the message.  I iniitally asked the team to investigate it further. I was away for a week but in that time our practice manager had investigated the matter further.  Once we were satisfied of what had happened i called both patients whose data had been breached. the first patient was fine and accepted my apology. The second patient also accepted my apology but wanted a text and letter to ackowledge the incident, in case of any problems later, whcih we have done.  I discussed the breach at our clinical meeting and with my partners.",3,"please see above","Richard Short","Implementing DPO recommendations","SIRO - Richard Short",null,null,null,null,"Based on previous experience of similar breaches, that have been reported to our DPO, and the fact that all three patients involved have had the situation explained  to them and they seem satisfied with the steps taken to contain the breach, the SIRO concluded that this can be classified as a MINOR breach.\r\n\r\nTherefore the matter can be handled at practice level.  \r\n\r\nThe SIRO has raised the following actions on this incident:\r\n\r\n1 Action for Dr Shah to treat as a learning opportunity\r\n2 Send an action to all staff to remind them of the importance of taking care when processing confidential patient data to check that it is being sent to the correct patient"," "]
["GDPR00002","Debbie Cleary","2020-04-21","2020-04-21","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Unredacted report sent to Ofsted",1,"Alerted OFSTED of the error and asked them to delete /shred the incorrect information sent in order to contain the breach.  Reported the breach to the SIRO for guidance on what further actions should be taken","Richard Short","Closed","SIRO - Richard Short","2020-04-22","2020-04-22","Minor","Use as a learning experience internally within the practice.  Send email to all staff reminding them of their responsibilities with regard to patient data.","Email sent to all staff reminding them of the need to exercise caution and care when handling and sending patient sensitive data."," "]
["GDPR00003","Richard Short","2023-07-06","2023-07-06","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","Mental Health Team sent an email to the Patient",1,"Ex Employee (GP) received patient sensitive data","Richard Short","Closed","SIRO - Richard Short","2023-07-07","2023-07-07","Minor","Minor Breach - no need to report to ICO - use as a learning experience internally within the practice","N/A"," "]
["GDPR00009",null,"2025-06-25","2025-06-25","Confidentiality&nbsp;- e.g. breach due to unauthorised access, potential breach due to lost record, etc.","This was brought to my attention by Dr L Mackensie. The patient had been in contact with reception Admin and they had brought the error to Dr L Mackenzie&rsquo;s attention.  I checked the information and found that I had sent the patient someone else&rsquo;s blood test form. I checked the other patient and I had not sent any wrong information to that person.",2,"I rang the person and explained my error, the person expressed that they did not want or need any further action on their part.The patient who received the wrong form was sent the correct form and reassured that their information had not been passed to another patient.","Richard Short","Reported to Management / GDPR Officer","SIRO - Richard Short","2025-06-26","2025-06-26","Minor","Email all staff to ensure they understand their responsibilities under the provisions of the GDPR act and the need to take care when handling patient sensitive data",null," "]