We have several PD candidacies brewing at work.
I work in a hospital.
PD candidate #1 - student nurse who, while working, convinced a staff member to look up records for her boyfriend's dying father, reading the information, then spreading all sorts of misinformation around to the family, causing much grief, confusion and consternation.
PD candidate #2 - the staff member who looked up the records.
This has been brought to light by a complaint to the hospital from one of the relatives. Relative wants nothing done, didn't name the PD trainee but mentioned she was now employed as an RN, and specified that this was because PD trainee's brother had repeatedly assaulted members of the dying man's family, and the relative was afraid of him.
Talk about impossible patron requests...
It should be relatively simple to find out the staff member who logged into the patient system to get the records (everything is logged), and once that happens it should be easy enough to find out who the trainee is. But we (hospital) can't do anything about it because the complaining relative wants nothing done. I suppose it means an eye could be kept on the now RN to see if there were any more violations of patient privacy (and anything else - particularly with her brother...) but that's all that can be done right now.
So, we have two staff members that have violated patient privacy laws, we don't as yet know who, and can't do anything about it right now. One of whom has a violent and apparently volatile brother. Talk about a ticking time bomb...