NHS staff snooping on medical records is ‘disgraceful breach of patient trust’
Cambridge University Hospitals has recently dismissed five members of staff for inappropriately accessing patient records
NHS staff looking at medical records out of curiosity is a “disgraceful breach of patient trust and against the law”, the head of the health service has said.
Listen to this article
Sir Jim Mackey was speaking after several investigations into whether staff have snooped on patient records without good reason.
Last month, Cambridge University Hospitals (CUH) said it was investigating after the medical records of a three-year-old boy hurt in a crocodile pit were accessed by around 40 members of hospital staff.
CUH referred itself to the Information Commissioner’s Office (ICO) and said it was looking at whether all the workers had a legitimate reason for looking at his information.
Separately, CUH has recently dismissed five members of staff for inappropriately accessing patient records.
Read more: Hospitals spending £2.7bn every year on patients fit enough to go home
In the same month, a former healthcare worker was cautioned by the ICO for trying to obtain and sell the medical records of the Princess of Wales.
In May, Nottingham University Hospitals NHS Trust (NUH) said “11 members of staff have been dismissed and a further 14 have had actions taken against them” for inappropriately accessing medical records of the Nottingham stabbing victims.
Students Barnaby Webber and Grace O’Malley-Kumar, plus grandfather Ian Coates, were stabbed to death by Valdo Calocane in 2023.
Sir Jim said on Wednesday that looking at records for personal reasons or out of curiosity would not be tolerated by the NHS.
The health service has launched a new campaign to remind staff what constitutes unlawful access, the potential impacts on patients and how staff could end up losing their jobs.
Employers can report breaches to the ICO and the police, who can launch criminal prosecutions, as well as to professional regulators.
The guidance from the NHS also tells employers to ensure appropriate technical controls are in place to protect people’s information without stopping staff from doing their jobs.
These can include “role-based” controls so only those involved in a patient’s care can access records and multi-factor authentication.
Sir Jim said: “Patients must be able to trust that their personal information is kept confidential by the NHS – any instance of staff looking at records without a valid reason is wholly unacceptable, a disgraceful breach of patients’ trust and against the law.
“While the majority of NHS staff handle patient information responsibly and professionally every day, it’s been incredibly worrying that a small number have chosen to undermine the trust that patients place in them and caused such additional distress for families who deserved so much better from us.
“Anyone considering accessing records for personal reasons or out of curiosity should be in no doubt they could be putting their career at risk and may face disciplinary action, dismissal, referral to the regulator or even time in prison.
“We will not tolerate a culture of curiosity when it comes to patient confidentiality – there is no place in the NHS for those who misuse patient information and together we will take firm action to prevent and monitor unlawful access, and to act decisively when that occurs.”