- The NHS warns that curiosity about patient records can permanently end healthcare careers
- Jail time now goes together with dismissal for illegal access to confidential medical records
- High-profile crime victims’ records sparked tougher NHS privacy enforcement nationwide
NHS England has launched a nationwide campaign warning staff that accessing patient records without proper legal justification could end their careers.
The initiative includes screensavers and posters across NHS organizations reminding workers not to let curiosity override professional and legal boundaries.
Staff who breach these confidentiality rules face disciplinary action, dismissal, legal citation or even imprisonment under existing data protection legislation.
A response to recent high-profile breakups
The campaign follows several recent sackings involving staff who illegally viewed records linked to victims of high-profile crimes across the country.
NHS England specifically cited incidents of illegal access involving the 2023 Nottingham attacks and the 2024 Southport knife attack, both of which attracted significant national attention.
“Patients must be able to trust that their personal information will be kept confidential by the NHS – any instance of staff looking at records without a valid reason is completely unacceptable, a disgraceful breach of patient trust and against the law,” said Sir Jim Mackey, NHS Chief Executive.
He added that most staff manage patient information appropriately, although a limited group have seriously damaged that trust through inappropriate access.
New guidance has now been published outlining different categories of illegal access, along with advice on monitoring and carrying out regular audits.
Some newer electronic health record systems can reportedly flag suspicious activity in real time, helping organizations quickly identify unauthorized access.
Breaches can be reported to both the Information Commissioner’s Office (ICO) and the police, who may pursue criminal prosecution under the Data Protection Act 2018.
Legal consequences and independent results
The ICO reiterated the expectations of patients and staff as well as the consequences of this illegal action.
“When people seek medical care, they share some of their most sensitive personal information in the confidence that it will be kept safe,” said Paul Arnold, chief executive of the ICO.
“Unauthorized access to these records is not just a breach of data protection law – it is a betrayal of that trust, with real and lasting consequences for patients and their families…Staff who breach that trust face serious consequences: loss of employment, removal of professional accreditation and criminal prosecution.”
The temptation to illegally access patient records often increases when cases attract wide public attention.
“When a local incident becomes national news—a serious crime, a public tragedy, a story that captures widespread attention—there is an increased risk that health care professionals may be tempted to look at records they have no reason to look at,” Arnold added.
“Anyone who considers accessing records for personal reasons or out of curiosity should be in no doubt that they could be putting their careers at risk and could face disciplinary action, dismissal, referral to the regulator or even jail time,” said Sir Jim Mackey.
Findings show that 18 staff at York and Scarborough Teaching Hospitals have improper access to patient records since 2021.
Eight of these 18 cases were subsequently referred to the ICO for further formal investigation.
Another investigation began after up to 40 staff allegedly accessed the medical records of a three-year-old boy injured in a crocodile incident near Huntingdon.
Cambridge University Hospitals said restrictions had already been placed on the child’s records and confirmed that any staff missing legitimate clinical or operational reasons will face disciplinary action, including dismissal.
Offenses under the Data Protection Act 2018 and the Computer Misuse Act 1990 can carry fines and prison terms for those convicted.
The scale of these repeated incidents suggests that existing safeguards have not consistently deterred staff from illegally viewing sensitive records.
“Having the ability to view a record is not the same as having a legitimate need to do so. Every member of staff has a personal responsibility to respect this boundary…” Arnold added.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds.
