NHS staff suspected of snooping on patient records face immediate suspension

NHS staff suspected of looking at patients’ records without a legitimate reason face immediate suspension and loss of system access while the facts are investigated, following a fresh intervention from NHS England.

The warning, issued on 25 September, concerns the misuse of access entrusted to healthcare staff. It reaches beyond the technical question of who can open a record and asks why that person needed to see the information.

It also raises a difficult question for patients: if somebody has looked at a record without permission, how would the patient ever know?

NHS Employers confirmed that NHS England chief executive Sir Jim Mackey had written to trust leaders, reinforcing a policy of strict action on unjustified access. Its account says unauthorised access will, in almost all cases, amount to gross misconduct. Updated advice accompanied the letter.

Sky News reproduced the letter and reported Mackey’s expectation that staff suspected of snooping should be suspended and have their access to NHS systems removed immediately while an investigation establishes what happened.

The letter follows a Sky News investigation into the handling of patient-data breaches across NHS trusts. It identified 2,914 cases investigated since 2021, of which 409 were referred to the Information Commissioner’s Office.

Sky also reported that 67 per cent resulted in a minor sanction or no further action. Of the 134 trusts responding to its information requests, only 54 said they routinely looked for potential breaches.

The September intervention comes from NHS England. The underlying confidentiality and data-protection duties apply more widely, but the instruction should not be presented as a new UK-wide employment law.

Suspension while an investigation takes place does not establish misconduct. There may be an innocent explanation, including an incorrectly selected patient, a similar name or a system that opened the wrong record.

NHS England’s professional guidance says accidentally opening a record during legitimate work will not automatically amount to unlawful access, provided the person stops reviewing it once the mistake is recognised.

The purpose of removing access during an investigation is to protect patient information while the facts are established.

The ICO addressed this distinction in June. Healthcare staff may need rapid access when patients move between services, but the technical ability to view a record does not establish a legitimate reason to do so.

Any access must still be authorised, necessary for the task and consistent with the organisation’s policies.

NHS England says curiosity about friends, relatives, colleagues, former patients and people appearing in the news can amount to unlawful access. Staff can also breach the rules by using clinical systems to look at their own records or those of relatives, even where the relative has given informal permission. The proper patient-access route must be used instead.

Not necessarily. Opening a record does not always alter the clinical information visible to the patient. There may be no new note, appointment or prescription to indicate that anybody has been there.

The evidence is generally held in the system’s audit trail. NHS England says electronic health and care systems keep logs showing who searched for and accessed particular records. Unusual access should be investigated under the organisation’s procedures.

Patients are not generally sent a notification every time an authorised member of staff opens their record. For many people, examining access is not as simple as signing into the NHS App.

That makes proactive monitoring important. An audit log can show what happened, but only if it is preserved and someone is prepared to examine it.

NHS England says individuals can request information about who has accessed and contributed to their health and care record by making a subject access request.

The request should identify the relevant organisation and provide enough detail to help locate the information, including the patient’s NHS number, the service involved and the dates of concern.

Different organisations may hold different parts of a patient’s information. A GP practice, hospital trust, mental-health provider and shared-care service may operate separate systems or retain separate audit records. It may therefore be necessary to approach more than one organisation.

A subject access request does not guarantee that every staff member’s name will be disclosed. Information relating to other people may need to be considered separately, and some details may be redacted where a lawful restriction applies.

That should not prevent the organisation from carrying out the underlying search or explaining what it has established. If information is withheld, the organisation should identify the basis for its decision and explain the available complaint rights.

The ICO says organisations normally have one month to respond to a subject access request. A further extension of up to two months may be available where a request is complex, but the requester must be told about the extension and the reason for it within the initial month.

A subject access request seeks the patient’s personal information. A data-protection complaint asks the organisation to investigate whether the information was accessed or used improperly. A patient can make both.

The complaint should also ask the organisation to preserve the relevant audit logs immediately. Patients can contact the organisation’s Patient Advice and Liaison Service, Data Protection Officer, information-governance team or Caldicott Guardian. Contact details will usually appear in the organisation’s privacy notice.

Under the current data-protection complaints framework, the organisation has 30 days to acknowledge a complaint. It must investigate, keep the complainant informed and provide an outcome without unjustified delay.

Not every suspected or confirmed breach leads to direct notification. An organisation must assess the possible effect on the person concerned. Where a personal data breach is likely to create a high risk to somebody’s rights and freedoms, the organisation must tell that person without undue delay.

Health records may contain information about mental health, fertility, sexual health, safeguarding, domestic abuse, gender identity or other matters disclosed with a high expectation of confidentiality.

The threshold for reporting a breach to the ICO is different from the threshold for notifying the patient. A reportable breach should normally be notified to the ICO within 72 hours of the organisation becoming aware of it. Direct notification to the affected person is required where the breach is likely to create a high risk.

This means a patient might not be told about every incident. The organisation must still record its breach assessment and the action it took.

If the response leaves the concern unresolved, the patient can complain to the ICO.

The ICO can examine an organisation’s handling of personal information, but it does not award compensation. A person who believes they have suffered damage because an organisation broke data-protection law can seek compensation directly from the organisation or consider court proceedings. A breach does not automatically produce a financial award, and independent legal advice may be appropriate.

ConsumerWise’s view is that the real test will not be how strongly the latest warning is worded. It will be whether organisations actively monitor access, preserve reliable audit trails, investigate concerns promptly and give affected patients a meaningful explanation.

Internal reminders can reinforce the rules. They cannot replace technical controls, regular audit checks or accountability when misuse is discovered.

The fact that an organisation can identify who opened a record after a complaint is important. The more difficult question is whether it would have detected the access if nobody had complained.

Patients should not have to become investigators simply to find out whether the confidentiality promised to them was respected.