NHS to Suspend Staff for Snooping on Patient Records
The head of NHS England announced new measures to address unauthorized access to sensitive patient data, including immediate suspension for suspected breaches.
Staff within the National Health Service (NHS) suspected of improperly accessing patient records will now face immediate suspension, according to new directives from the head of NHS England. This policy change aims to curb instances where employees have abused patient trust by snooping on sensitive medical information.
Instances of unauthorized access have included staff looking up the health records of relatives, acquaintances, and former partners. In one documented case from 2023, an NHS consultant in Cambridgeshire was investigated by the General Medical Council (GMC) for accessing the health history of a woman who had begun dating the doctor's ex-boyfriend. Another case involved at least five members of staff at Southmead Hospital potentially accessing the records of a patient named Oliver, whose mother, Paula McGowan, has been an advocate for greater data protection following his death in 2016. McGowan stated that she was informed of the potential breaches earlier this year.
Paula McGowan welcomed the NHS's commitment to addressing the issue but stressed the need for "meaningful action." She emphasized that medical records contain deeply personal information and that accessing them without a legitimate clinical or professional reason constitutes a serious breach of trust with significant consequences.
The NHS does not operate a single, unified electronic record system accessible by all staff. Instead, individual organizations, such as GP practices and hospitals, maintain their own record systems. These organizations determine who has permission to view specific information. Crucially, IT systems are designed to keep an audit trail, which should document precisely who accessed a patient's records and at what time.
Bristol NHS Foundation Trust, in relation to the Southmead Hospital case, stated that a "thorough investigation" was underway and that it would be "inappropriate to reach conclusions before those enquiries are complete." The new policy signals a stricter approach to enforcing data privacy within the health service.