Man's confidential HIV status leaked and complaints ‘evaded’ as Sheffield private hospital is accused of 'back alley medicine'

The man, who is 33 and must remain anonymous to keep his HIV status confidential, said that BMI Thornbury ‘deliberately misled’ him as he sought to complain about their breach of confidentiality rules.

This meant he was passed between numerous different organisations for more than eight months – including Sheffield Teaching Hospitals, the Department for Health, Sheffield Clinical Commissioning Group, the Care Quality Comission and the health ombudsman – as he searched for the correct person to complain to and was told, time and again by each one, that it was not their responsibility.

The man’s treatment remains suspended, he says his ‘many questions’ remain unanswered and his complaint has yet to be dealt with.

Last September, the patient went to see his GP about an ongoing pelvic problem he has suffered with for a number of years.

He was referred by his GP to Sheffield Teaching Hospitals, and the treatment was outsourced to BMI Thornbury on Fulwood Road, which allows private hospitals to take on NHS work.

The patient, who is a key worker and was working throughout his ordeal, said: “The surgeon was very dismissive and then agreed to write to my GP referring me back into Sheffield general and also advising I use an asthma inhaler as they contain a drug that could help with my condition.

"I was driving back down to Surrey and I called my GP about it and they said they could not prescribe me that because it was unlicensed, so I needed a letter from the surgeon.

"I called the surgeon’s secretary and said I need the letter as soon as possible. They said they would be in touch in a few days.

"They sent the letter to my GP and then my GP's secretary sent it via email to me and I realised not only did the letter document details of my confidential HIV status, bit it had also been sent to the wrong patient email address because the surgeon's private secretary had typed it out wrong.

"I said there has been a serious data breach and you need to call me as soon as possible. They called me and said I had misquoted the email to them - which I had not - and then they apologised and said the surgeon would be in touch.”

Five weeks then passed before the patient contacted BMI Thornbury, who said they would investigating, and would be in touch in January 2021.

The patient explained: "In the middle of January, I got a letter from the Surgeon acknowledging in part the data breach but blaming me for it as he said that I had rushed him into writing the letter. The Surgeon said he was going to advise my GP to discard that letter and send an amended version.

"The new letter removed the offending bits of information, but then, at the bottom, it said that the surgeon was no longer able to help. Even though in the original, offending letter, it had listed my diagnosis and what was to be suggested as treatment going forward. That was all gone in the second letter.”

The patient said he was now concerned about both the data breach that disclosed his HIV status, and the fact that his treatment appeared to have been stopped pending an unspecified new surgeon picking up where the previous one had left off.

However, when he sought to complain about the way he had been treated, the patient said he entered into a ‘confusing and distressing’ eight months of “pinging between different big organisations where nobody wants to take accountability.”

The patient said: “I contacted BMI Thornbury and they said write to NHS England. I had already rang them but NHS England said they only deal with primary care.

"They said this again and told me to go to PALS. But I had already tried PALS via the trust and was told it was not theirs to deal with. I then contacted the CCG who said they would try to assist. I also contacted the DfH and they said I had to go through the PALS process.”

Throughout the process, the patient has also contacted the health ombudsman, various LGBTQ+ charities and the CQC.

The CQC undertook an investigation between January and March, and also erroneously informed the patient that he should approach Sheffield Teaching Hospitals with his complaint as he was an NHS patient.

On numerous occasions the patient was told that the reason the organisations were not responsible was because the data breach had been made by the consultant’s private secratary, who was not employed by BMI Thornbury or any other organisation.

Early in August, The Star contacted BMI Thornbury, outlining the details of the patient’s experience and asking why there had been a data breach in the first place and why it had taken so long for the patient to be able to submit a complaint.

A spokesperson for BMI Thornbury said: “We cannot comment on the specific details of individual cases, but this incident has been examined independently by a regulator. They concluded that BMI Thornbury had no case to answer and acted entirely appropriately at all times.”

But on August 20 a letter from Christopher Buckingham, regional director at BMI, addressed to the patient said: “The CCG has contacted me to to discuss whom has responsibility for the management of your complaint.

"Following my discussion with the CCG, we concluded that, as you were referred by your GP to a service operated by BMI, the responsibility for managing your complaint is ours and not Sheffield Teaching Hospitals’.

"I am therefore writing to you to confirm that BMI accepts responsibility for the management of your complaint.”

The consultant and his secretary have been informed by The Star of the patient’s allegations and were given the opportunity to comment. At the time of writing they have not replied.

The letter goes on to offer the patient a meeting with the consultant to discuss the issue. The patient says he has also been offered a meeting with Kosta Antoniou, BMI’s executive director.

The patient said: “I have alarming questions over BMI Thornbury Hospital refusing to handle a complaint until now, as well as providing inaccurate information to CQC.

“[I also have] questions over BMI Thornbury changing its stance on its responsibility after six months. Why checks weren't put in place to make sure Thornbury were following the correct information?

"I have been fighting this system for the best part of seven months. I have many questions that have gone unanswered.

"Why was there a data breach, why is there this complaint scandal where I can’t complain because nobody will take responsibility?

"It is like back alley medicine with the way this has been handled. This has happened, but seemingly not under anyone’s watch.”

A person’s HIV status is protected medical information. It is considered particularly densitive due to the stigma HIV positivity can carry.

When contacted by The Star, Sheffield Teaching Hospitals, Sheffield CCG and the CQC said they were unable to comment as responsibility for the breach and the complaints process lay with BMI Thornbury.

Sheffield sports coach calling for more defib machines to be sited at workplaces after father collapsed on football field

Dozens attend funeral of tragic Afghan boy as Sheffield 'shows its sense of community'

Heartbreaking details revealed at opening of inquest into death of tragic Afghan boy who fell from hotel window in Sheffield