THE CRUNCH
Britain's privacy watchdog has told healthcare executives to personally confirm they are doing enough to stop staff snooping through patient records, after receiving more than 300 reports of inappropriate access this year. The Information Commissioner's Office (ICO) said on Thursday that it had written to more than 200 senior health leaders across the UK, warning that employees opening files without good reason put patient privacy and public trust at risk. Chief executive Paul Arnold wants to know who can access patient records, whether anyone is checking what they look at, and what happens when somebody is caught. Executives have until 27 November to respond.
The reports, submitted by healthcare organisations between January and mid-October 2026, cover allegations rather than confirmed breaches, and exclude cases still awaiting assessment. Staff were reportedly caught looking up people they knew, browsing files out of curiosity, and sharing private information with others who had no business seeing it. "Accessing someone's health records without a legitimate reason isn't harmless curiosity. It can cause enormous distress to patients and jeopardize the vital trust people place in our health service," Arnold said.
The core problem is not hacking: most staff already have legitimate access to records as part of their jobs, and the trouble starts when they use it to look up a neighbour, an ex-partner or someone in the news. Bosses who have not reviewed their safeguards in the past six months, or are unhappy with what they find, have been given a further three months to put things right. Arnold warned that the regulator could take enforcement action against organisations whose protections fall short.
The crackdown follows earlier warnings. In July, NHS England told employees that accessing records without a legitimate reason could cost them their jobs or lead to prison, after incidents involving the records of victims of high-profile crimes including the Nottingham attacks. The UK government told Parliament in July that 1,445 cases of inappropriate access were reported to the ICO between 2019 and 2025, and the watchdog has prosecuted 16 healthcare workers for snooping over the past decade. Unauthorised access to personal information can amount to a criminal offence under the Data Protection Act 2018.