UK medical record snooping: ICO presses 200 NHS bosses

What does the ICO want health bosses to do?

ICO chief executive Paul Arnold's three-page letter says trusting staff to behave isn't enough. He wants to know who can open patient records, whether anyone checks what they look at, and what happens to people caught snooping. Suspected breaches should be investigated promptly, patients told where needed, and action taken against the staff involved.

Executives have until 27 November to reply. Anyone who hasn't reviewed their safeguards in the past six months, or doesn't like what they find, gets another three months to fix things. Arnold also warned of possible enforcement action against organisations whose protections fall short.

Why is this happening?

Mostly it isn't hacking. Many health workers legitimately have access to records for their jobs. The trouble starts when they use it on a neighbour, an ex-partner or someone whose name has been in the news. Some newer electronic patient record systems can flag suspicious access in real time, though NHS England admits monitoring varies by the technology installed.

Not the first warning

In July, NHS England warned staff that accessing records without good reason could cost them their jobs or even lead to prison. That followed cases involving the records of victims of high-profile crimes, including the Nottingham attacks. The government also told Parliament that 1,445 cases of inappropriate access were reported to the ICO between 2019 and 2025.

The ICO has prosecuted 16 healthcare workers over the past decade. Unauthorised access to personal data can be a criminal offence under the Data Protection Act 2018.