The UK’s data watchdog has cracked down on NHS staff who look at patients’ medical records without a good reason, writing to more than 200 senior health leaders to demand action.
The Information Commissioner’s Office (ICO) stepped in after more than 300 reports of staff accessing medical records without justification between January and mid-October 2026. In each case, staff had opened records they had no work reason to view.
Health service executives have until 27 November to give the watchdog assurances that they are tackling the problem. The ICO wants to see clear evidence that trusts are checking who looks at records and acting when access cannot be justified.
The warning follows advice from NHS England in July, which said that looking at records without a valid reason could cost staff their jobs or lead to prosecution. Despite that warning, reports of unjustified access have continued to arrive.
Medical records hold some of the most sensitive personal information there is, from diagnoses and treatments to details about family life. Patients trust that only the staff directly involved in their care will open their files, and that trust is damaged every time a record is viewed out of curiosity.
The ICO said health leaders must make sure staff understand the rules and that systems are in place to spot misuse quickly. The crackdown is part of a wider push to protect patient privacy across the health service.
Most NHS staff never look at a record they should not, and the watchdog’s action is aimed at the small number who do. But the figures show the problem is not rare, and health leaders are now under pressure to show that audits and spot checks are catching it.
Patients can ask their GP practice or hospital about how access to their records is checked. The watchdog’s message to health leaders is clear: patient records are private, and anyone who looks at them without a reason will be found out.
Source: The Register
