my company stores patient's hospital invoices?

Question

when the managers themselves have said that they should not hold that information

We are a team of medical debt collectors and we hold copy invoices for people who have haid smear tests, hysterectomies etc

who do I contact to report this, because it is a breach of data protection

Answer 1

Probably the PCT or NHS Trust.

Answer 2

Bill collection is a legitimate use for medical data under HIPPA.

If you're not being carefull with it and it falls into the wrong hands there could be a legal issue, but you're certainly entitled to have it.

Otherwise how would you collect a bill?

You:"Hello Mrs Jones, I'm calling on behalf of City Labs, you owe them $100"
Her:"Oh, really, what for?"
You:"I don't know, I don't have the invoice"
Her:"Pound sand"
click

Richard

Answer 3

Actually, it's possible that under HIPPA regulations such data is to be kept for a specified time than destroied. It's dependant on how HIPPA defines those rules with respect to the type of business your firm is doing. Google HIPPA records retention rules...or call the Feds and ask.