A retired historian has been left with a £18,000 bill after losing a battle over control of her own medical records - in a case which could have implications for thousands of patients

Sara Tenneson, of St Mary’s Way in Chigwell, was shocked last year to be handed a referral letter by the River Surgery in Buckhurst Hill, containing medical details of a traumatic, but unrelated, incident dating back to 1995.

She persuaded the surgery to remove the details when it re-issued the referral letter, but it refused repeated requests to delete the details from her medical records.

Afraid that the information could leak again, Mrs Tenneson, 65, took the surgery to court under the Data Protection Act which requires organisations, on request, to remove information if that information causes unnecessary damage or distress to the person concerned.

When she arrived in court, she found the surgery represented by the Medical Defence Union and a leading QC, who argued that the need to keep records up to date outweighed the distress caused to her.

Unbeknown to her, the surgery and its solicitor had also commissioned a report from another GP who claimed there was a possibility that, at some point in the future, a medic might need access to the 1995 information.

Mrs Tenneson hotly disputed his findings, but did not have the money to commission an expert of her own.

She said: “I couldn’t afford it and it wasn’t necessary.

"We would not have that sort of money, and we really felt that, given the evidence, we didn’t need it.”

The judge slammed the surgery for its error in releasing the information on the referral letter, adding: “What happened simply should have not have happened under any circumstances.

“The fact that it happened, not surprisingly makes her fear it may well happen again.” 

But he accepted the QC’s interpretation of the Data Protection Act, and refused to allow the deletion of the information.

Mrs Tenneson has been ordered to pay the surgery’s costs within two months, and threatened with arrest if she does not.

She said: “This £18,000 plus is an enormous sum of money, life changing for us, and for many years I will be paying for the surgery’s mistake.

“Once I knew this information was there, all I ever wanted to do was protect it and make sure that it was safe, secure and confidential and would never be disclosed or breached.”

• Mrs Tenneson says that her case need never have gone to court if the surgery had had a proper complaints procedure in place.

In the weeks after the leak occurred, she repeatedly asked unsuccessfully for a copy of the GPs’ complaints procedure.

She said that the surgery would not name its complaints manager, offered no written details of how the investigation would be carried out, and refused requests for the commonly used mediation or conciliation procedure.

She claims that when she took up the matter with the now defunct NHS West Essex, she was told that it could not intervene because the complaint was being dealt with by the surgery.

She said: “If someone had just sat down with me, one to one, in confidence and in private so that we could talk about what had happened, go through and use all the NHS procedures that are there for us as patients, then none of this would have happened.

“But no-one would ever talk to me. All I got back from the surgery was the matter is closed we will not correspond with you further, with no acknowledgement that these NHS processes existed, let alone are there for all of us to use. 

“I am sure that this traumatic, appalling and distressing situation would not have happened if someone had just talked to me, there was no need to have to go to court.”

No-one at the surgery was prepared to talk to the Guardian, but the Medical Defence Union issued a statement on its behalf which read: “We are sorry to hear that such concerns have been expressed regarding the outcome of this complaint.

“We take our responsibilities as data controllers very seriously and have reviewed our processes to ensure they comply with the law and ethical guidance.

"The court order made in this case upheld the continuing processing of the information concerned.

“We cannot comment further on the case because of our duty of patient confidentiality.”