UK health sector warned to tackle medical record snooping

The ICO is calling on health leaders across the UK to act now to stop staff viewing medical records without a legitimate reason, warning that unauthorised access is putting public trust in the health sector at risk.

ICO Chief Executive Paul Arnold has today written to over 200 of the most senior leaders in the health service across the UK urgently asking for their personal assurance that measures are in place and working effectively to prevent and detect staff prying into medical records.

The letter stresses that protecting patients is about more than processes, but also being assured that the right culture and behaviours are in place. When unauthorised access does occur, organisations must take proportionate action, consider the impact on the person affected and recognise the importance of keeping them informed. The letter also builds on practical advice and good practice recommendations we set out to the sector in June.

We have received over 300 reports of unauthorised access from health sector organisations so far this year. Reports include staff looking at records with no legitimate need, viewing the records of people they know or sharing information with others, raising serious concerns about whether medical records are being properly protected.

The warning also follows a growing number of recent high-profile cases of unauthorised access to medical records across the UK, which cause real distress to patients and their families.

Paul Arnold, ICO Chief Executive, said:

Accessing someone's health records without a legitimate reason isn't harmless curiosity. It can cause enormous distress to patients and jeopardise the vital trust people place in our health service.

I've written to chief executives across the UK asking them to personally assure me that their safeguards work in practice. Where they don't, we expect organisations to put that right. This isn't only about processes - it's about driving the right culture and behaviours to make sure those processes are respected and followed.

This message goes beyond the health sector: any organisation entrusted with people's most sensitive information has a duty to protect it and we will take action if they fall short. I strongly encourage leaders in every sector to ask themselves whether their safeguards would stand up to the same scrutiny.

We're asking health leaders to personally confirm that their organisations are actively:

• Controlling who can see patient records, with access granted, reviewed and removed appropriately.
• Spotting suspicious access, using effective monitoring and audit systems to identify when records may have been viewed inappropriately.
• Confident that every member of staff knows what is expected of them and aware of the consequences of accessing medical records without authority.
• Acting when something goes wrong, investigating suspected unauthorised access promptly, considering the impact on the person affected and taking appropriate action where wrongdoing is established.

Senior leaders should confirm that they have reviewed their organisation's approach in these areas within the past six months. Those who have not are expected to complete a review within the next three months. The responses will help shape the regulator's next steps to respond to this issue and help protect patient's privacy.

We're also working with organisations across the UK to drive sector-wide improvements, including the National Data Guardian in England.

If people are worried about how an organisation has handled their personal information, they can ask the organisation to look into it and raise a concern with the ICO if they are not satisfied with the response.