The head of the NHS has issued a stark warning to staff that they face the sack or even prison if they access patient records without a legitimate reason, as part of a new crackdown by the health service.
Sir Jim Mackey said that staff looking at medical records for personal reasons or out of curiosity was “wholly unacceptable, a disgraceful breach of patient trust and against the law”, and would not be tolerated by the NHS.
Sir Jim’s warning comes as the NHS today launched a new campaign to remind staff what constitutes unlawful access, the potential impacts on patients and what the consequences could be for their career.
The campaign follows several incidents of staff being dismissed from their posts after accessing the medical records of victims of high-profile crimes, including the Nottingham attacks.
NHS England has published new guidance for all NHS organisations on preventing and monitoring unauthorised access, as well as their responsibilities in investigating and reporting it.
The guidance sets out the different types of unlawful access, and makes clear that where it occurs, employers may report it to the Information Commissioner’s Office (ICO) and police – both of whom have the power to pursue a criminal prosecution – as well as to professional regulators, which can end a career.
It also provides guidance for how monitoring and regular audits can be conducted depending on the IT systems organisations have in place. For example, some newer electronic patient record systems may be able to identify unlawful access in ‘real’ time, with the capability to set up alert ‘flags’ to identify suspicious activity.
Employers are being asked to ensure appropriate technical controls are in place for their organisation to protect people’s information without stopping staff from doing their jobs – such as ‘role-based’ controls – and minimising access to very sensitive information to only those that must see it to fulfil their role, and multi-factor authentication.
NHS England’s new campaign launches with screensavers on staff computers and posters around NHS organisations urging staff to protect patients’ privacy, respect confidentiality, and not to ‘let curiosity kill your career.’
Sir Jim Mackey, NHS Chief Executive, said: “Patients must be able to trust that their personal information is kept confidential by the NHS – any instance of staff looking at records without a valid reason is wholly unacceptable, a disgraceful breach of patients’ trust and against the law.
“While the majority of NHS staff handle patient information responsibly and professionally every day, it’s been incredibly worrying that a small number have chosen to undermine the trust that patients place in them and caused such additional distress for families who deserved so much better from us.
“Anyone considering accessing records for personal reasons or out of curiosity should be in no doubt they could be putting their career at risk, and may face disciplinary action, dismissal, referral to the regulator or even time in prison.
“We will not tolerate a culture of curiosity when it comes to patient confidentiality – there is no place in the NHS for those who misuse patient information and together we will take firm action to prevent and monitor unlawful access, and to act decisively when that occurs.”
Paul Arnold, ICO Chief Executive Officer, said: “When people seek medical care, they share some of their most sensitive personal information in the trust that it will be kept safe. Unauthorised access to those records is not just a breach of data protection law — it is a betrayal of that trust, with real and lasting consequences for patients and their families.
“Having the ability to view a record is not the same as having a legitimate need to do so. Every member of staff has a personal responsibility to respect that boundary, and every patient has a right to expect that they will. Staff who breach that trust face serious consequences: loss of employment, removal of professional accreditation and criminal prosecution.”
