When information is shared wrongly or something goes wrong

Mistakes happen: a letter may go to the wrong address, a text to the wrong number, a result discussed with the wrong person, or a record opened by mistake.

The safest response is to report the incident promptly. Delaying or concealing a confidentiality incident can increase harm and make it harder for the practice to put things right.

Examples of possible incidents

• Wrong recipient: message, email, letter, prescription information or report sent to the wrong person.
• Wrong record: note, document, task or scan added to the wrong patient record.
• Wrong disclosure: information given to a caller without authority.
• Lost information: printout, list, device or notebook containing patient details misplaced.
• Unauthorised access: record opened without a work-related reason.

What to do immediately

Follow the practice incident process and tell the appropriate manager, information governance lead, data protection lead or a senior clinician as soon as possible. Give factual details: what happened, when, whose information may be involved, who received it, what has already been done and whether there is any immediate safety concern.

Do not try to fix the incident privately. Do not delete evidence unless instructed through the proper process. Do not contact the recipient or the patient unless the person managing the incident asks you to do so.

Learning without blame

Reporting incidents helps the practice reduce future risk by improving templates, identity checks, address checking, printer controls, shared inbox rules, staff training or system alerts.

Near misses matter. If a wrong-patient text was spotted before sending, or a printout recovered before leaving the building, the practice can still learn and adjust procedures.

Data breach reporting

Report confidentiality incidents promptly; early reporting gives the practice the best chance to reduce harm and learn.