Highlights:
- Suspected snoopers could be suspended immediately
- NHS access may be cut before investigations finish
- More than 200 staff have been dismissed since 2020
- Some workers accessed records out of curiosity
- 1,445 cases were reported to the ICO
What happens when an NHS employee is suspected of secretly looking at your medical records?
Until now, staff accused of inappropriate access could remain in their jobs while investigations took days or weeks. NHS England chief Jim Mackey now wants that approach changed.
He has told all 205 NHS trusts in England to take a “zero tolerance” approach, with suspected snoopers suspended immediately and blocked from NHS computer systems while the facts are established.
“Patient records contain some of the most private information people will ever share. We have seen too many cases of people abusing that trust and enough is enough.”
Curiosity could cost someone their career
The crackdown comes after cases in which NHS workers allegedly accessed records without a clinical reason.
Mackey issued a blunt warning to anyone tempted to look at a patient's information simply out of curiosity.
“Anyone who thinks they can satisfy their curiosity by looking at a patient’s record should know this: they will be found out, they may lose their career and could end up with a criminal record.”
The scale of previous disciplinary action helps explain the tougher approach.
Since 2020, more than 200 NHS employees in England have been dismissed and around 2,000 others sanctioned for snooping on patient records, according to an investigation by Sky News and the Health Service Journal.
Some cases involved hundreds of records
The investigation found cases involving particularly serious breaches.
One NHS employee was dismissed after accessing the records of up to 179 people. Another accessed their spouse’s information in what was described as a “potential domestic violence situation.” Other employees reportedly shared information obtained from patient records in WhatsApp groups.
Responses from 140 NHS trusts showed that 214 staff were dismissed, three suspended and 540 given final written warnings over the five years examined.
Why the crackdown is happening now
The issue has also surfaced in several high-profile cases involving people connected to major attacks.
NHS staff were reported to have accessed the medical records of victims of the 2023 Nottingham attacks involving Valdo Calocane and the 2024 Southport stabbings involving Axel Rudakubana.
In another case, Bristol NHS Foundation Trust apologized after at least five staff members, including three nurses and a doctor, accessed the medical records of Oliver McGowan, who died in 2016 at age 18.
Government figures show health service bodies reported 1,445 cases of inappropriate access to the Information Commissioner’s Office between 2019 and 2025.
The ICO has stressed that such behavior remains uncommon among NHS workers.
Paul Arnold, the watchdog's chief executive, said in June: “inappropriate access is rare and does not represent the behaviour of the vast majority of healthcare staff who take their duty of confidentiality extremely seriously”.
