November 12, 2026 - 198 views
Health service leaders across the UK are being urged to strengthen safeguards protecting patients' medical records, after the Information Commissioner's Office reported more than 300 cases of unauthorised access by healthcare staff so far this year.
The data protection regulator has written to more than 200 senior health service leaders, asking them to personally confirm that effective measures are in place to prevent staff looking at medical records without a legitimate work-related reason.
The warning covers incidents including employees accessing the records of people they know, looking up information out of curiosity and sharing confidential medical details with others.
The ICO says that simply having access to a computer system does not give staff permission to look at any patient's information.
Chief Executive Paul Arnold says unauthorised access can cause considerable distress and undermine the trust people place in the NHS.
He is asking health organisations to review who has permission to access records, whether suspicious activity is being identified through monitoring systems, and whether staff understand the consequences of breaching patient confidentiality.
Organisations are also expected to investigate suspected incidents promptly, consider the impact on affected patients and take appropriate action where wrongdoing is established.
The issue is not confined to England or to high-profile cases. Published reports show that incidents involving inappropriate access to patient information have also been recorded by NHS organisations in Wales.
In North Wales, Betsi Cadwaladr University Health Board's 2018/19 annual report recorded eight data security breaches which were referred to the ICO and Welsh Government. One was described as involving inappropriate access to a computer system.
The report does not explain whether that incident involved someone deliberately looking at a patient's medical records, or establish that it was an instance of staff snooping. However, it demonstrates that inappropriate system access has previously featured in the health board's own data security reporting.
The board also has a formal procedure for investigating suspected unauthorised access. This includes using monitoring reports to identify staff who may have viewed family members' records, colleagues' records or other records without an obvious work-related reason.
There are also more specific examples elsewhere in Wales.
Cardiff and Vale University Health Board's annual report for 2021/22 recorded an incident in which a member of staff had regularly viewed a relative's medical record. Another involved an employee accessing their manager's health records on three occasions.
Both were among four personal data security incidents reported to the ICO during that financial year.
Hywel Dda University Health Board has also reported incidents involving unauthorised access to medical records and information being disclosed in error. Its audit reporting for 2025/26 said three incidents were still being investigated by the ICO.
These examples underline that the problem is not simply theoretical, although they do not suggest that inappropriate access is widespread among NHS staff. The vast majority of healthcare workers need to access confidential information as part of their jobs and are expected to handle it responsibly.
There are legitimate reasons for staff to view medical records, including providing treatment, arranging care and supporting clinical investigations. The concern is when information is accessed for personal reasons or out of curiosity rather than as part of someone's professional responsibilities.
Under data protection legislation, deliberately obtaining or disclosing personal information without the consent of the data controller can amount to a criminal offence. Staff can also face disciplinary action, dismissal and referral to professional regulators.
The ICO's latest intervention is intended to ensure that health organisations do more than simply have confidentiality policies in place, with senior leaders expected to demonstrate that safeguards are working in practice.
Patients who are concerned that someone may have accessed their medical records without permission can raise the matter with the relevant health board or healthcare provider's information governance team. If they are unhappy with the response, they can also contact the Information Commissioner's Office.
