- NHS warns curiosity about patient records could permanently end healthcare careers
- The prison sentence is now added to the dismissal for illegal access to confidential medical records
- High-profile crime victim records sparked stricter NHS privacy enforcement across the country
NHS England has launched a nationwide campaign warning staff that accessing patient records without adequate legal justification could end their careers.
The initiative includes screensavers and posters in all NHS organizations reminding workers not to let curiosity override professional and legal boundaries.
Staff who breach these confidentiality rules risk disciplinary action, dismissal, regulatory referral or even imprisonment under existing data protection legislation.
A response to recent high-profile breaches
The campaign follows several recent dismissals linked to staff who illegally viewed records related to high-profile crime victims across the country.
NHS England specifically cited incidents of trespassing related to the 2023 Nottingham attacks and the 2024 Southport knife attack, both of which attracted significant national attention.
“Patients must be able to trust the NHS to keep their personal information confidential – any case where staff review records without a valid reason is totally unacceptable, a disgraceful breach of patient trust and against the law,” said Sir Jim Mackey, chief executive of the NHS.
He added that most staff manage patient information appropriately, although a limited group have seriously damaged that trust through inadequate access.
New guidelines have been published outlining different categories of illegal access, along with advice on monitoring and carrying out regular audits.
Some newer electronic patient records systems can reportedly detect suspicious activity in real time, helping organizations quickly identify unauthorized access.
Breaches can be reported to both the Information Commissioner’s Office (ICO) and the police, who can initiate criminal proceedings under the Data Protection Act 2018.
Legal consequences and independent conclusions
The ICO reiterated the expectations of patients and staff, as well as the consequences of this illegal action.
“When people seek healthcare, they share some of their most sensitive personal information with the confidence that it will be kept secure,” said Paul Arnold, chief executive of the ICO.
“Unauthorized access to those records is not just a breach of data protection law: it is a betrayal of that trust, with real and lasting consequences for patients and their families…Staff who breach that trust face serious consequences: loss of employment, removal of professional accreditation and criminal prosecution.”
The temptation to illegally access patient records often increases when cases attract widespread public attention.
“When a local incident becomes national news – a serious crime, a public tragedy, a story that garners widespread attention – there is an increased risk that healthcare personnel may be tempted to look at records they have no reason to look at,” Arnold added.
“Anyone considering accessing records for personal reasons or curiosity should have no doubt that they could be putting their career at risk and could face disciplinary action, dismissal, referral to the regulator or even imprisonment,” Sir Jim Mackey said.
The findings show that 18 staff at York and Scarborough University Hospitals improperly accessed patient records since 2021.
Eight of those 18 cases were subsequently referred to the ICO for further formal investigation.
Another investigation began after up to 40 staff reportedly accessed the medical records of a three-year-old boy injured in an incident at a crocodile enclosure near Huntingdon.
Cambridge University Hospitals said restrictions had already been placed on the boy’s records and confirmed that any staff found lacking legitimate clinical or operational reasons would face disciplinary action, including dismissal.
Offenses under the Data Protection Act 2018 and the Computer Misuse Act 1990 can lead to fines and imprisonment for those convicted.
The magnitude of these repeated incidents suggests that existing safeguards have not consistently deterred staff from illegally viewing confidential records.
“Having the ability to view a record is not the same as having a legitimate need to do so. Each staff member has a personal responsibility to respect that limit…” Arnold added.
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
