NHS Warns Staff They Could Face Dismissal or Prosecution for Unlawfully Accessing Patient Records

NHS England has launched a new campaign warning healthcare staff that accessing patient records without a legitimate work-related reason could lead to disciplinary action, dismissal, referral to professional regulators or even criminal prosecution.

The campaign has been introduced alongside new national guidance to help NHS organisations prevent, detect and investigate unauthorised access to confidential patient information. NHS England says the guidance is designed to strengthen patient confidentiality and ensure organisations have appropriate safeguards in place.

The new guidance advises NHS organisations to implement measures such as role-based access controls, multi-factor authentication and regular audits of electronic patient record systems. It also highlights that some newer digital systems can identify potentially inappropriate access in real time by using automated alerts to flag suspicious activity for investigation.

The campaign follows several incidents in which NHS staff were found to have accessed the medical records of high-profile patients without a valid clinical or operational reason. NHS England says that while the vast majority of staff handle patient information responsibly, any misuse of confidential records is a breach of patient trust and may also breach data protection law.

Where unlawful access is identified, employers may refer cases to the Information Commissioner’s Office, the police and professional regulators where appropriate. Depending on the circumstances, individuals could face disciplinary action, dismissal, loss of professional registration or criminal prosecution.

NHS England says the campaign aims to reinforce the importance of protecting patient confidentiality while supporting organisations to strengthen information governance and maintain public confidence in the handling of sensitive health information.

Stay informed with the stories shaping health and social care.