NHS clarifies when staff can legitimately access patient records

NHS England has clarified the circumstances in which healthcare staff can legitimately access patient information, following concerns about how rules governing access to medical records should be interpreted.

The clarification confirms that accessing patient data is not unlawful simply because a member of staff is not directly involved in providing clinical care to that individual, provided there is a legitimate professional purpose for accessing the information.

The issue was highlighted by The BMJ, with NHS England setting out a broader range of circumstances in which staff may have a valid reason to view patient information as part of their work.

Legitimate purposes can extend beyond direct treatment and may include activities necessary for the operation, management and improvement of health services, where the individual accessing the information is authorised to do so and the information is necessary for their role.

However, the clarification does not give NHS staff unrestricted access to patient records. Accessing information without a genuine work-related reason — including looking at the records of friends, relatives, colleagues or other patients out of curiosity — can still constitute inappropriate or unlawful access.

NHS England’s data protection policy states that personal information must only be collected and processed for specified, explicit and legitimate purposes. Staff should also only use information that is adequate, relevant and necessary for the purpose for which it is being accessed.

The organisation warns that deliberately or recklessly obtaining or disclosing personal data without appropriate authority can potentially constitute a criminal offence under the Data Protection Act 2018. Inappropriate access may also result in disciplinary action.

The clarification comes as the NHS prepares for greater sharing of health information through the development of the Single Patient Record, which is intended to bring together patient information from across health and social care.

NHS England says the new system will use role-based access controls and audit trails, allowing organisations to monitor who has accessed patient information and identify unusual or potentially inappropriate activity.

The development highlights the balance facing the NHS as it seeks to make information more readily available to professionals who genuinely need it, while maintaining patients’ confidence that sensitive health information remains protected.

Stay informed with the stories shaping health and social care.