Crackdown on UK medical record snooping after staff reported sneaking 300+ times this year
Britain's privacy watchdog has put healthcare bosses on notice after receiving more than 300 reports of staff snooping through medical records this year, demanding that executives personally confirm they're doing enough to keep prying eyes out of patient files.
Key points
- With hundreds of reports already landing on the watchdog's desk this year, healthcare bosses now have a fortnight to explain how they're keeping staff out of records they have no business reading.
- Health bosses are also expected to investigate suspected breaches without dragging their feet, work out whether patients need to be told, and take action against staff caught accessing records they shouldn't.
- Some newer electronic patient record systems can even flag suspicious access in real time, although the NHS acknowledged that monitoring capabilities vary depending on the technology organizations have installed.
The ICO received and assessed more than 300 reports of medical record snooping between January and mid-October 2026.
That crackdown followed incidents involving staff accessing the medical records of victims of high-profile crimes, including the Nottingham attacks.
Additional details
- The ICO has prosecuted 16 healthcare workers for snooping through patient records over the past decade, with unauthorized access to personal information potentially amounting to a criminal offense under the Data Protection Act 2018.
- ICO chief executive Paul Arnold wants health bosses to personally assure him that their organizations have safeguards in place to stop staff having a nose through records they aren't supposed to see.
- Staff were caught looking up people they knew, poking around patient files out of sheer curiosity, and sharing private information with people who had no business seeing it.
- He wants to know who can access patient records, whether anyone is checking what they're looking at, and what happens when somebody gets caught snooping.
- In July, the UK government told Parliament that 1,445 cases of inappropriate access had been reported to the ICO between 2019 and 2025.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →
Advertisement
Every article behind this summary — 1 article from 1 outlet
Get stories like this in your inbox.
Subscribe — it's freeOne free email at 6am — your topics, deduplicated, five minutes. No account, no paywall.