NHS staff accessing medical records inappropriately in high profile or tragic news stories.

[HavfrueDenizKisi]

What the hell is wrong with people who work for the NHS and still somehow think it’s ok to voyeuristically access the medical records of patients who have been in the news?

Just read this article about 40 members of staff being investigated over the inappropriate viewing of this poor boy’s medical records. Read a similar article a few weeks back about the medical records of the victims of the Nottingham attack being accessed. Something like 11 people were sacked and 12 given final warnings about that (somehow suggesting it wasn’t their first time doing so).

Surely it is pretty fucking clear when you start working for the NHS that this is Absolutely Not Allowed. Plus it must be clear that there is a digital trail left behind of anyone accessing records. Honestly the mind boggles.

Link to article on BBC:

https://www.bbc.co.uk/news/articles/cvg5kvpdd15o

If your NHS software development team has been able to easily build something which balances speed of use with a really efficient way of automatically dentifying inappropriate access, I'd love to hear about it.

Who said I work in NHS IT ?

I've just retired from a career in various industries, with over 20 years of experience in financial software, where improper access to customer data can attract serious fines and reputational damage.

Also, I note your use of the word "easily", which is usually management synonym for "cheap". Forgetting the classic maxim:

"On time. On budget. Works. Pick any two".

The main issue is that the management of NHS trusts are not tasked with delivering effective, targeted treatment with the best possible outcome of the patient in mind. They are tasked with managing the NHS Trust to deliver the best possible outcomes for the heath authority and the Department of Health. Which to be fair they generally knock out of the park.

Remember, NASA engineers were able to not only reprogram Voyager II at a distance of hundreds of millions of miles and hours delay. They were able to inspect and isolate damaged hardware in order to keep a machine launched in 1977 with 1960s tech working decades beyond it's design life.

I am allergic to "can't" in IT. It invariably is a weasel way of saying "won't" to hoodwink the unwary.

This isn't unique to healthcare. Data protection generally is a bit of a dressing up game. When it's taken seriously things might change.

Apologies, parts of your posts made it sound like you have some experience in NHS software development.

I used the word easily because you saying deliver something which just works gave the impression that this would be easy to deliver and/our you'd easily delivered something similar. Apologies for misunderstanding. I don't actually think it would be easy.

I'm absolutely not saying it "can't" be done - our developers actually very rarely say can't. One of their favourite phrase is "pretty much anything is possible". However though this may well be technically possible, it's not going to be practically possible any time soon because of lack of the various resources I mentioned in another post. I'm not part of trust management, so have zero influence on which of a huge list of competing priorities gets done first and completely understand that on time, on budget and working isn't possible (currently working on yet another project which has gone beyond its deadline because we don't the money to employ enough people).

Patients do have a right to access their own records via a Subject Access Request. Just because you work in the NHS, it doesn’t mean that policy doesn’t reply to you and you can just go ahead and look at your records.
These days, most people have access to the NHS app, which includes tests results etc, meaning that the info is actually there at your fingertips.

You may think you’re right, but that doesn’t stop it being a sackable offence.

I'm absolutely not saying it "can't" be done - our developers actually very rarely say can't. One of their favourite phrase is "pretty much anything is possible".

We put a man on the moon nearly 60 years ago. Measure everything by that yardstick, and see how suddenly "can't" becomes "won't".

I don't mind pragmatic and necessary decisions in life. I do mind them being dressed up in a lie to disguise political choices.

If there is shit software in the NHS, it's not because decent software doesn't exist, or can't be delivered. It's because the management have decided that is what has to be.

I realise that in 2026 you can't really expect management to manage on top of all the other work they have to do. Which is probably why it's better I'm getting out of it. We need a completely fresh workforce who understand that it's their role to run the outfit in order to ease the burdens of management.

A doctors receptionist who used to be a friend of mine accessed the medical records of a family member of mine, and came to my house to specifically tell me what she saw. No remorse, or even suggestion she was breaking the law.

At my school we actually can all access all records, which is useful if you are going on a trip/overnight/afterschool activity with another class. I have used it for not just my class to prepare for such events. However, I’m well aware there’s a trail and that I would have to explain any search at any time.

I have worked in banking for eons and accessing customer information with a valid reason is a disciplinary offence. In the NHS they should be fired immediately. It’s disgusting.

People will still do it but the more consequences there are maybe it will reduce the number who do.

That said it’s almost impossible for those not in customer related roles to access customer data. Maybe the NHS needs to look at its access management processes.

They are fired immediately.

did you report her?

Quite a lot of NHS systems - certainly the ones I've bumped into - come with modules that have to be paid for to enable functionality.

This is why the two hospitals that I am seen by are unable to exchange scans and medical images between identical systems (A consultant asked me if I could remember how they looked).

Apparently, when they moved Selly Oak Hospital into the new QE hospital, it was cheaper to hire vans to move the records to be re-entered into the new system than pay for the export and import from the two (naturally) different systems. Admittedly this was 15 years ago.

Not according to the info in the OP.

"What do you think of data protection in the UK ?"

"I think it would be a good idea."

Not always the case. The receptionist at my old surgery has been caught twice and just given “re-training”, which is ridiculous

In certain practices GP receptionist was the post hardest to hire to. People just didn't want the job.

You can only access patient administration systems with a username and password. You won't be given these credentials without having a job that requires it.

I do find that rule rather odd. When I worked in a library people had to have their library cards. But if I forgot mine I could access my record to take out books. Staff perk :) I know not quite the same but I don't see why you can't access your own information.

Although you can see a lot on the NHS app now in some areas (notably not Scotland).

Patients don’t always have a right to all of the information in their notes - the notes are used for communication between HCPs so may sometimes contain info the patient has no right to (sometimes including our personal contact details so that we can get hold of each other); they may also have information relating to other people; the notes may contain serious diagnoses that the patient hasn’t yet been told about because their clinic appointment isn’t until next week or whatever; they may contain other info that is thought to be harmful for various reasons. Patients do have a right to request their notes and if any of the above scenarios are relevant that info will be redacted, but not to look at them themselves and not to info that may relate to 3rd parties. This includes staff as well as ‘normal’ patients.

I'd hope that access is more granular. It should be possible to restrict certain fields to certain roles or logins. (mandated under GDPR by the Principle of Integrity and Confidentiality (Article 5(1)(f)), enforced via Security of Processing (Article 32), and designed through Data Protection by Design and by Default (Article 25)).

Meanwhile, last consult I had, the consultant spent 10 minutes showing me images from somebody elses records on screen untold I asked "Whose name is that in the corner, it's not mine"

Because we are, as staff, privy to a lot more information than the ordinary patient, and also have the ability to change things. It’s auditable on the newer systems, but on the older systems it was a lot harder to do. Imagine if someone changed their waiting list priority or booked appointments before they were top of the waiting list?

You are correct, is more granular. My apologies, I should have explained the permissions settings better. Thanks for raising that.

As a 17 year old working in banking back in 2004 I learnt very quickly that you are not allowed to access anything that isnt relevant to the job you are doing. Myself and a collegue got into a lot of trouble because I innocently allowed them to use my user log in on the one reception computer and they made a mistake which flagged up my name
After that one incident and lots of additional training the importance of data protection was something I took very seriously.

I imagine that high profile individuals and celebrities would have restricted access flags added to their electronic records, much like patients who are under safeguarding arrangements or looked after children. These restrictions are fairly easy to override if you have a legitimate reason, but the system requires you to select a justification (such as clinical necessity or administrative update) and usually enter a comment explaining why you accessed the record—for example, “Printing referral at doctor’s request” or “Overriding to inform patient of appointment.” If the access is later audited, there is at least a documented reason and explanation (which is why I always write War and Peace when I override the system - to protect myself).

In practice, someone with dishonest intentions could potentially exploit legitimate workflows. For example, they might claim a doctor was having problems with their login and asked them to check something on their behalf, or say they needed to read the previous clinic letter to determine the patient’s outcome (which happens a lot at my work place). Another plausible excuse could be that the patient had phoned asking for an update about their appointment. Rather than searching by name, they could search using the patient’s NHS number or date of birth (as though they have phoned up and asked them their date of birth/NHS number), making the access appear routine at the patient’s request.

I remember someone who purposely “lost” patient’s paper outcome (several times) so that, when they were later asked by a supervisor to chase up the outstanding outcome, they had an excuse to access the patient’s last letter. When another colleague reported her, she defended herself with, “The patient was on the late outcome list and I was asked to investigate.” Because that was a legitimate work related justification, nothing ever came of it.

Ultimately, electronic access controls create an audit trail and can deter inappropriate access, but they cannot completely prevent someone from abusing legitimate reasons for viewing records. Similarly, if someone has authorised access to physical paper notes, it is difficult to stop them from looking through them for reasons unrelated to their work.

I’ve also been told that accessing the record of a deceased patient attracts much closer scrutiny. On our system, a deceased patient’s banner turns black, making it immediately obvious that the patient has died. A colleague once accidentally clicked on the wrong patient during a clinic (they meant to select the name above but instead opened the record of a deceased patient). Within a day they were called in by their supervisor to explain the access. Fortunately, the audit logs showed they had only been on the record for a second before returning to the clinic list and hadn’t opened any clinical letters or other documents, so it was accepted as a genuine mistake.

If that’s the level of scrutiny for an accidental click, I imagine the monitoring is even tighter following a high profile death or widely publicised tragedy. If multiple staff members with no clinical relationship to the patient suddenly accessed the record, those accesses would be likely to stand out in the audit logs and prompt an investigation. That may explain why inappropriate access to the records of patients involved in high profile cases has, in some instances, been identified relatively quickly.