Royal Mail staff given access to confidential medical details
Benefits application forms are routinely opened and sorted by postal workersConfidential medical information from sick and disabled people applying for welfare benefits is opened and sorted by Royal Mail staff on behalf of the Government without the claimant's knowledge or consent, The Independent can reveal.
Medical experts reacted angrily to the potential for breaches in confidentiality after it emerged that the Department of Work and Pensions (DWP) routinely uses Royal Mail to process the thousands of benefits claims, including health data, it receives every day.
The revelations have prompted fresh concerns about the fact that the handling of sensitive personal information can be legally outsourced without the subject's consent.
For example, people applying for sickness benefits such as employment support allowance (ESA) must first complete a detailed medical questionnaire explaining their conditions, prescribed medication and therapies, and the names and addresses of their doctors and nurses.
The form, which also includes highly sensitive questions about addictions and mental illness, is then posted in a pre-addressed envelope to the DWP or Atos Healthcare – the Paralympics sponsor paid by the Government to carry out controversial assessments of claimants' capacity to work.
However, it has emerged that these envelopes are routinely opened and the contents sorted by the Royal Mail, unless the envelope is specifically marked "private and confidential". In those cases they are sent to Atos unopened, according to the DWP.
The information came to light after Lynne Neagle, a Welsh Assembly member, was asked to investigate by a constituent who was told by a local post office not to bother sending ESA forms by special delivery as the envelope would be opened by Royal Mail regardless.
Former RAF man John Williams, 50, from Pontypool in south Wales, received incapacity benefit (the precursor to ESA) for 10 years, because he was unable to work as a result of arthritis and post-traumatic stress disorder. He was recently declared fit for work – which means that his benefit will stop after 12 months whether he has a job or not – and was posting his appeal documents when told about Royal Mail's role. "Nowhere in any of the paperwork does it say that a third party is involved," he said. "People are sending very personal information and have a right to know this is happening; I feel like I've been misled."
Ms Neagle said: "These claimants often have incredibly complex case histories – they may have mental health problems or be victims of sexual abuse – I imagine they'd find it incredibly unsettling to know that such deeply personal information was being treated like this.
"While I have no reason to doubt the absolute integrity of the Royal Mail staff involved, that's not the point – they simply should not have access to this kind of information."
The DWP said security measures were in place to minimise the risk of any data breaches, including CCTV in sorting rooms and procedures that mean at least two people open the mail together.
"We are a large organisation that handles all kinds of sensitive information. We use Royal Mail to sort and direct our mail to the appropriate processing centre," a spokesman said. "We hold the contract and ensure they abide by the same data protection and security checks as any DWP employee."
Dr Tony Calland, chair of the British Medical Association ethics committee, said the security was irrelevant: "We are very concerned that a government department could even contemplate allowing such sensitive and confidential medical data to be handled by a third party without the person's consent."
An Atos Healthcare spokeswoman said: "We're subject to the postal arrangements set by the DWP. Once we receive information we strictly comply with all of the Government's confidentiality and data security regulations. Where the envelope is addressed directly to Atos Healthcare it is opened by our staff."
Freedom of Information Request Sent To The DWP“In the light of recent revelations reported in The Independent newspaper on Saturday 8th September 2012 I am writing to request the following information in line with the Freedom of Information Act 2000 and in relation to the Data Protection Act of 1998, further amended in 2003.
http://www.independent.co.uk/news/uk/home-news/royal-mail-staff-given-access-to-confidential-medical-details-8118203.html1) How many letters meant for the Department for Work and Pensions (DWP), and which have NOT been marked ‘Private and Confidential’, have been opened by employees of Royal Mail since this practice began?
2) The same as in 1 but in relation to letters sent to Atos Healthcare, including but not limited to letters containing medical evidence as well as sickness and disability benefit forms.
3) Could you please clarify whether or not the revelations reported by The Independent are limited to a specific Royal Mail sorting branch, region, town or city in the United Kingdom, or whether this practice is being carried out nation-wide?
4) Under which laws and/or legislation does the DWP and/or Atos have the legal right to outsource the opening and sorting of such letters to third parties such as the Royal Mail?
I look forward to your quick reply”.
Mr S. Preece
Social Welfare Union
DWP Reply
DWP do not record the number of letters received that are marked private and confidential. Since the contract commenced in 2007 DWP has received 384,428,405 post items.
Similarly neither the Department nor Atos Healthcare collects management information about private or confidential letters opened by employees of the Royal Mail.
DWP post opening arrangements are nation-wide and are carried out at 27 Mail Opening Units.
The Secretary of State for Work and Pensions has the legal power to make contracts. This power is not derived from parliamentary legislation. The power comes from that of the Crown and English Common Law. The Secretary of State acting through the DWP contracted under the Office Services Contract its mail opening to Balfour Beatty Workplace who subcontracted this operation to the Royal Mail.
When making commercial contracts the DWP inserts safeguards to protect all personal data and to ensure compliance with the Data Protection Act 1998. The DWP as the Data Controller under that Act determines the purposes for which and the manner in which any personal data are, or are to be, processed. By opening the mail the Royal Mail as sub contractor to Balfour Beatty Workplace are acting as a Sub Data Processor.
The safeguards DWP has in place include that any contractor (the Data Processor) processes the Personal Data only in accordance with DWP instructions, and only to the extent and such manner as is necessary for the provision of the Services, implement appropriate measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure, and to take reasonable steps to ensure the reliability of any Staff who have access to the Personal Data and ensure that none of the Staff publish, disclose or divulge any of the Personal Data to any third party. All contractors will provide the DWP will full cooperation and assistance in relation to any complaint.
These protections will be mirrored in the Balfour Beatty and Royal Mail contract, both of whom have to comply with the Data Protection Act 1998 in any event.
If you have any queries about this letter please contact us quoting the reference number above.
Yours sincerely,
Communications Team
Commercial Directorate
DWP Finance and Commercial
official.correspondence@dwp.gsi.gov.uk