Snooping on Patient Records Exposes the Limits of NHS Data Governance
When a death reaches the national news, a particular kind of work begins inside some NHS organisations. Information governance teams wait to see who opens the file. This month it was Yorkshire, where two ambulance service staff are under investigation over access to the records of a man killed by a tiger. Earlier this year it was Southport, where nearly 50 staff at a single Liverpool trust were found to have looked inappropriately at the records of injured children. In Nottingham, 15 employees have been dismissed for viewing the records of those affected by the 2023 attacks, with dozens more disciplined short of dismissal.
The health secretary has called the latest case a total disgrace and wants suspension during investigations and dismissal where breaches are proven. As a statement of standards it is hard to fault. Patients and bereaved families will expect nothing less. But dismissal arrives at the end of a long chain, and the length of that chain is the real finding. The Nottingham outcome was reported more than three years after the attacks, and families have waited that long to learn how many people read their relatives' files.
The delay points to how access is commonly governed. In many NHS organisations, any member of staff with a legitimate login can open a wide range of records, and misuse is found afterwards through audit. Tools that interrupt this pattern exist. They include prompts requiring a stated reason, tighter role-based limits, and automatic monitoring of records belonging to patients involved in major incidents. Their use varies from trust to trust. A system that relies on staff declining to look, and on someone later checking whether they did, will keep producing these cases whenever a name becomes famous.
The timing matters because the government wants more data to move, and more freely. Plans for a single patient record, a larger role for the NHS App, a national federated data platform and the wider adoption of AI tools all depend on greater volumes of identifiable information being available to more people and systems. Life sciences strategy leans on the same foundation. Each expansion enlarges the population of people who could, in principle, browse. The public has already shown what happens when confidence in data handling falters. The care.data programme was abandoned in 2016 after trust drained away, and the lesson was costly.
The law is not silent here. Obtaining personal data without authority is a criminal offence under the Data Protection Act 2018, and the Information Commissioner has powers to act. Prosecutions have nonetheless been comparatively rare against the scale of the breaches now surfacing. Employers have tended to handle these cases as disciplinary matters, which is quicker and cheaper but offers little deterrent beyond the individual workplace. Registered professionals who are dismissed also raise questions for their regulators, and those links are not always made promptly.
There is a workforce dimension that ministers will find uncomfortable. The staff involved include doctors, nurses and other registered professionals in a service short of people. Nobody seriously argues for keeping an employee who reads a stranger's records out of curiosity. Yet a disciplinary process taking years, with staff continuing to work in the interim, serves neither patients nor colleagues. A national standard for suspension and investigation timelines, which the health secretary says she has discussed with the NHS chief executive, would remove the discretion that currently produces such uneven outcomes.
Practical consequences follow for several groups. Trust boards should expect to access audit data as routinely as they see waiting list figures, including how quickly anomalies are detected and resolved. Suppliers of clinical systems and health-tech firms seeking NHS contracts should expect proactive monitoring to become a procurement requirement rather than an optional extra. Policymakers promoting data sharing should publish the safeguards alongside the ambition, since the public is entitled to see both together.
The health service asks patients to accept that their most intimate information is held for clinical purposes only. Every breach that surfaces years after the event weakens that claim. Dismissals answer the individuals concerned. The reliability of a shared record depends on the strength of its audit trail, yet this remains an area where the system has not reached the standards needed to fulfil its ambitions.
