PhysioUpdate 30th May 2023

NHS trusts in England recorded more than 35,000 cases of rape, sexual assault, harassment, stalking, and abusive remarks in the years from 2017- 2022. The findings were released this morning (23 May) following an investigation conducted by The BMJ and The Guardian. The results show that NHS trusts are failing to protect staff and patients, prompting calls for an independent inquiry.

The data, based on responses to Freedom of Information requests from 212 NHS trusts and 37 police forces, show that a total of 35,606 sexual safety incidents were recorded on NHS premises over this five-year period.

At least 20 per cent of incidents involved rape, sexual assault, or kissing or touching that a person did not consent to, although not all trusts provided a breakdown of the type of incidents recorded. The other cases included sexual harassment, stalking, and abusive or degrading remarks. 

Paucity of policies

The data also show that patients are the main perpetrators of abuse in hospitals. Most incidents (58 per cent) involved patients abusing staff, with patients abusing other patients the next most common type of incident (20 per cent).  Police recorded nearly 12,000 alleged sexual crimes on NHS premises in the same time period. These include 180 cases of rape of children under 16, with four children under 16 being gang raped.

Fewer than one trust in 10 has a dedicated policy to deal with sexual assault and harassment, and no longer have to report abuse of staff to a central database. 

Latifa Patel, BMA workforce and equalities lead, said she assumed that trusts without dedicated sexual safety policies are ‘sitting on huge numbers of unreported incidents’ – which has a ‘truly disturbing implication’. The data show that 193 of the 212 trusts reported 10 or fewer staff-on-staff incidents between 2017 and 2022, but doctors described this as ‘implausible’ given the number of those employed and said that staff are reluctant to report sexual assault.

I know hundreds of female doctors who’ve been assaulted, thousands who’ve been harassed, and a decent number who’ve been raped within the NHS [Simon Fleming, orthopaedic registrar]

A 'painful truth'

Simon Fleming, an orthopaedic registrar and author of Sexual Assault in Surgery: A painful truth, said: ‘I know hundreds of female doctors who’ve been assaulted, thousands who’ve been harassed, and a decent number who’ve been raped within the NHS.’

And although more than 4,000 NHS staff were accused of rape, sexual assault, harassment, stalking, or abusive remarks towards other staff or patients in 2017-22, the investigation found that only 576 have faced disciplinary action.

When complaints are made against colleagues, women claim that NHS trusts show a ‘reluctance to suspend perpetrators due to overall staff shortages’, said Deeba Syed, senior legal officer for Rights of Women, a helpline that provides support for women who have been sexually assaulted or harassed at work. 

The Academy of Medical Royal Colleges, the Liberal Democrats, the Hospital Doctors Union, the GMB union, the Society of Radiologists and the British Dietetic Association have all called for an independent inquiry into the epidemic of sexual assault in the NHS in light of the findings.

What should trusts do?

Trusts need to be guided by NHS-wide policies on how to deal with allegations, including when to suspend staff and when to report individuals to the police, and should act swiftly to deal with complaints, say Tamzin Cuming and Carrie Newlands, from the Working Party on Sexual Misconduct in Surgery.

Health secretary Steve Barclay said that the government has doubled the maximum sentence for those who are convicted of assaulting health workers and is working closely with NHS England to prevent and reduce violence against staff.

Three 'sanctioning mechanisms'

In a linked opinion article, Simon Fleming said that everyone has a responsibility to hold sexual predators in the NHS accountable or risk becoming complicit bystanders. ‘Criminal behaviour should be dealt with seriously, regardless of who has committed the crime. He added: ‘Failure to challenge, individually or organisationally, these attitudes is akin to accepting them as “just how things are”.’

In another opinion article, Rosalind Searle, from the Adam Smith Business School at the University of Glasgow, said failures to record, investigate, and act on cases of sexual harassment and abuse in healthcare have enabled perpetrators. She outlines three sanctioning mechanisms – self, social, and legal sanctions – that are needed to reduce these violations in workplaces and society.

To join a BMJ webinar on this topic on 8 June, click 

To read the main article - titled Medical colleges and unions call for inquiry over ‘shocking’ levels of sexual assault in the NHS doi:10.1136/bmj.p1105 – visit: https://www.bmj.com/content/381/bmj.p1105

To read the two opinion articles, visit: https://www.bmj.com/content/381/bmj.p1117 and https://www.bmj.com/content/381/bmj.p1094

As healthcare technology continues to advance, the security of patient data is more critical than ever. With electronic records and other digital information used daily, healthcare practices must take steps to protect sensitive patient information from cyber threats.

In February 2023, Banner Health, a non-profit health system headquartered in Phoenix, Arizona, paid a settlement of $1,250,000 to the U.S. Department of Health and Human Services Office for Civil Rights to resolve a data breach that disclosed the information of nearly 3 million consumers. This is only one of many examples reflecting the cost implications that data breaches can have in the health sector.

Do you have measures like practice policies in place to manage data security risks and help ensure patient data is protected? By prioritising data security, your healthcare practice can provide patients with peace of mind that your practice is serious about keeping their personal information safe and secure.

1.        Using weak passwords: Healthcare practitioners often choose easily guessable passwords, making patient information vulnerable. To combat this, try incorporating strong password policies into practice policies, including using passwords that are at least 8 to 12 characters long and contain a combination of uppercase and lowercase letters, numbers, and special characters.
2.        Using screensavers without password protection: Leaving computers unattended with screensavers that don't require a password increases the risk of unauthorized access. Password-protecting screensavers and using two-factor authentication (2FA) are recommended for added security.
3.        Failure to adequately train employees: Insufficient training on data security policies and procedures can lead to accidental data disclosures, downloading malware, falling victim to phishing attacks, and non-compliance with regulations. Regular training sessions, mock phishing tests, and creating a culture of security are suggested to mitigate risks.
4.        Sharing practice management software accounts: Sharing accounts increases the risk of unauthorized access. Each team member should have unique login credentials and strict user permissions. Monitoring user activity can help ensure accountability.
5.        Failing to regularly update software: Outdated software is vulnerable to cyberattacks and may not comply with regulations. Enabling automatic updates, regularly checking for updates, using antivirus software, and monitoring end-of-life software are recommended.
6.        Failing to secure networks: Unsecured networks can lead to unauthorized access, malware infections, and non-compliance with regulations. Data encryption is a key method of keeping these networks secure as well as using firewalls and VPNs, monitoring network activity, and developing network security policies.
7.        Disposing of data and hardware incorrectly: Improper disposal of hardware and hard copies of patient information can lead to unauthorized access. Securely erasing data and shredding hard copies are important. The recommended approach is to create a comprehensive data disposal plan and training team members on it.
8.        Keeping paper records: Paper records increase the risk of theft and loss. Using cloud-based practice management software is an easy way to digitise patient records.
9.        Not using secure, ISO 27001 certified practice management software: Choosing software that meets strict information security requirements, such as ISO 27001 certification, ensures adherence to best practices. Power Diary is an ISO 27001 certified practice management software.

Securing practice data is crucial for maintaining business continuity and upholding the reputation of healthcare practices. Implementing staff training and data security policies and using secure software are essential steps in protecting sensitive patient information.

Implementing staff training and data security policies and procedures takes time and effort. But, it’s a non-negotiable requirement for maintaining business continuity and upholding the reputation of your healthcare practice in today’s world.

With its ISO 27001 certification, Power Diary proves it’s among the most secure practice management software options available. They offer a free trial to give you the chance to see just how effective it is, not only for data protection but also for the growth of your practice. Try it out to see what peace of mind can look like today!

This article has been paid for by Power Diary.