NHS to suspend staff suspected of snooping on patient records

NHS England chief executive Sir Jim Mackey has ordered an immediate, nationwide suspension of any staff suspected of unauthorised access to patient records, barring them from all NHS computer systems, including remote log‑ins. The directive, sent to every trust, follows a spate of high‑profile breaches that have involved the confidential files of victims of the Nottingham and Southport attacks and a child injured in a Cambridgeshire crocodile enclosure. This week Bristol NHS Foundation Trust announced an internal probe after it emerged that the medical records of an 18‑year‑old had been accessed years after his death, prompting his mother, Paula McGowan, to describe the situation as “deeply concerning and hurt”. Mackey warned that anyone who “satisfies their curiosity” by viewing a patient’s file will be identified, could lose their career and may face criminal prosecution.

The crackdown is part of a broader effort to curb a pattern of data abuse that the NHS says has become intolerable. An investigation by the Health Services Journal this month identified at least 214 staff members who have been dismissed and roughly 2,000 who have received sanctions for illicit snooping over the past five years. Motivations have ranged from curiosity about high‑profile patients to personal interest in the records of relatives, acquaintances or ex‑partners. In 2023 a Cambridgeshire consultant was referred to the General Medical Council after looking up the health history of a woman dating his former boyfriend. The NHS’s fragmented electronic record landscape—where GP practices, hospitals and specialist clinics each maintain separate systems—relies on audit trails to pinpoint who accessed a file and when, but the sheer volume of breaches suggests oversight has been insufficient.

The response has been framed as a “hard‑line” approach, accompanied by a national campaign reminding staff of their legal duties and the severe consequences of unlawful access. Mackey emphasised that patient records contain some of the most private information individuals will ever share, and that the NHS must protect that trust. Southmead Hospital in Bristol has been told that at least five staff members may have accessed the records of McGowan’s autistic son Oliver, who died in 2016, as recently as this year. While the trust says it will conduct a “thorough investigation” and refrain from premature conclusions, McGowan urged that the NHS’s commitment translate into “meaningful action”. The wider implication is a push for tighter governance across the disparate NHS IT systems, aiming to restore public confidence and ensure that future breaches are swiftly detected and punished.

⚡ Effects Interpreter