NHS England suspends staff suspected of unauthorized patient data access

NHS England has ordered the immediate suspension of staff members suspected of accessing patient records without a legitimate clinical reason, marking a significant escalation in its campaign against data breaches. Sir Jim Mackey, chief executive of NHS England, wrote to all hospital trusts instructing them to implement these measures without delay.

Under the new directives, individuals under investigation will be forcibly removed from NHS computer systems, preventing any further viewing of confidential medical data, including access from remote locations. The initiative is described as part of a “zero-tolerance crackdown” on the unauthorized inspection of sensitive health information.

The policy shift follows several widely publicized incidents, including the improper access of records belonging to victims of the Nottingham and Southport attacks, as well as a child injured in a crocodile enclosure in Cambridgeshire. Additionally, Bristol Foundation NHS Trust recently announced an internal probe after discovering that the medical files of an 18-year-old patient had been accessed years after his death in 2016.

Paula McGowan, the mother of Oliver McGowan, expressed that she was “deeply concerned and hurt” by the breach. She noted that at least five staff members at Southmead Hospital may have accessed her son’s records without authorization as recently as this year. While welcoming the NHS’s commitment to tackling the issue, McGowan emphasized the need for “meaningful action,” stating that accessing medical records without professional cause is a severe breach of trust that must carry consequences.

Sir Jim Mackey stressed the gravity of the situation, noting that patient records contain some of the most private information individuals share. “We have seen too many cases of people abusing that trust, and enough is enough,” he said, warning that curious staff members risk losing their careers and facing criminal records.

Data obtained by the Health Services Journal indicates that over the past five years, at least 214 NHS employees have been dismissed and approximately 2,000 have faced sanctions for snooping. Offenses have ranged from viewing the details of high-profile patients to looking up records of relatives, acquaintances, and former partners. In one notable 2023 case, a Cambridgeshire consultant was investigated by the General Medical Council after accessing the health history of a woman dating the doctor’s ex-partner.

Although the UK does not have a single unified electronic record system, with individual practices and hospitals maintaining their own databases, audit trails are designed to track exactly who accessed specific records and when. The Bristol NHS Foundation Trust confirmed it is conducting a thorough investigation into the McGowan case and stated it would be inappropriate to draw conclusions before the enquiries are finalized.