Sir Jim Mackey: NHS boss threatens to sack staff for snooping on medical records
The head of the NHS has threatened to sack unauthorized staff who view patients’ medical records after describing the action as a “disgraceful breach of patient trust and against the law”.
Sir Jim Mackey’s strong words follow a series of investigations into healthcare professionals accessing sensitive information without a legitimate reason.
Last month, Cambridge University Hospitals (CUH) launched an investigation after it was reported that around 40 staff had accessed the medical records of a three-year-old boy injured in a crocodile pit.
The trust has referred itself to the Information Commissioner’s Office (ICO) and is assessing whether each individual has a valid reason to view the child’s data.
Separately, CUH recently dismissed five employees for similar improper access to patient records.
At the same time, a former healthcare worker received a warning from the ICO for trying to buy and sell medical records belonging to the Princess of Wales.
In May, Nottingham University Hospitals NHS Trust (NUH) said it had “dismissed 11 staff and taken action against a further 14” for improperly accessing medical records of stabbing victims in Nottingham.
Students Barnaby Webber and Grace O’Malley-Kumar and grandfather Ian Coates were stabbed to death by Valdo Calocane in 2023.
Sir Jim said on Wednesday that looking at records for personal reasons or out of curiosity would not be tolerated by the NHS.
The health service has launched a new campaign to remind staff what constitutes illegal access, the potential impact on patients and how staff could lose their jobs.
Employers can report breaches to the ICO and professional regulators as well as the police, who can pursue criminal prosecution.
The NHS guidance also tells employers to ensure appropriate technical controls are in place to protect people’s information without preventing staff from doing their jobs.
These may include “role-based” controls so that only people involved in the patient’s care can access records and multi-factor authentication.
Sir Jim said: “Patients should be able to trust that their personal information will be kept confidential by the NHS; staff looking at records without a valid reason is completely unacceptable, a shameful breach of patients’ trust and against the law.
“While the majority of NHS staff handle patient information responsibly and professionally every day, it is incredibly worrying that a small number of people have chosen to undermine the trust patients place in them and cause so much additional distress to families who deserve so much better than us.
“Anyone considering accessing records for personal reasons or out of curiosity should be in no doubt that they may be putting their career at risk and could face disciplinary action, dismissal, referral to the regulator or even imprisonment.
“We will not tolerate a culture of curiosity when it comes to patient privacy; there is no place in the NHS for those who misuse patient information and together we will take decisive action to prevent and monitor unlawful access and act decisively when it occurs.”
