Britain's privacy watchdog has put healthcare bosses on notice after receiving more than 300 reports of staff snooping through medical records this year, demanding that executives personally confirm they're doing enough to keep prying eyes out of patient files. The Information Commissioner's Office (ICO) said on Thursday that it had written to more than 200 senior health leaders across the UK, warning that employees accessing records without good reason put patient privacy and public trust at risk. The ICO received and assessed more than 300 reports of medical record snooping between January and mid-October 2026. Staff were caught looking up people they knew, poking around patient files out of sheer curiosity, and sharing private information with people who had no business seeing it. The figure covers reports submitted by healthcare organizations rather than confirmed breaches, and excludes cases still awaiting assessment. ICO chief executive Paul Arnold wants health bosses to personally assure him that their organizations have safeguards in place to stop staff having a nose through records they aren't supposed to see. "Accessing someone's health records without a legitimate reason isn't harmless curiosity. It can cause enormous distress to patients and jeopardize the vital trust people place in our health service," Arnold said. In a three-page letter to chief executives, Arnold makes clear that simply trusting staff to behave themselves won't cut it. He wants to know who can access patient records, whether anyone is checking what they're looking at, and what happens when somebody gets caught snooping. Health bosses are also expected to investigate suspected breaches without dragging their feet, work out whether patients need to be told, and take action against staff caught accessing records they shouldn't. Executives have until November 27 to respond. Those who haven't reviewed their safeguards in the past six months, or aren't happy with what they find, have been given another three months to put their house in order. The problem isn't necessarily that healthcare workers are hacking into systems, as many already have legitimate access to patient records as part of their jobs. The trouble starts when they use that access to look up someone they're not treating, whether it's a neighbor, an ex-partner, or somebody whose name has appeared in the news. This isn't the first time health authorities have tried to stamp out the problem. In July, NHS England warned employees that accessing records without a legitimate reason could cost them their jobs or even land them in prison. That crackdown followed incidents involving staff accessing the medical records of victims of high-profile crimes, including the Nottingham attacks. NHS England also published guidance encouraging organizations to use access controls and audit systems to catch employees poking around where they shouldn't. Some newer electronic patient record systems can even flag suspicious access in real time, although the NHS acknowledged that monitoring capabilities vary depending on the technology organizations have installed. The scale of the problem has been troubling regulators for years. In July, the UK government told Parliament that 1,445 cases of inappropriate access had been reported to the ICO between 2019 and 2025. And the consequences can go beyond getting the sack. The ICO has prosecuted 16 healthcare workers for snooping through patient records over the past decade, with unauthorized access to personal information potentially amounting to a criminal offense under the Data Protection Act 2018. Arnold warned that the regulator could also take enforcement action against healthcare organizations whose protections aren't up to scratch. "I've written to chief executives across the UK asking them to personally assure me that their safeguards work in practice. Where they don't, we expect organizations to put that right," he said. With hundreds of reports already landing on the watchdog's desk this year, healthcare bosses now have a fortnight to explain how they're keeping staff out of records they have no business reading. ®
:format(jpeg):fill(f8f8f8,true)/s3/static.nrc.nl/podcasts/wp-content/blogs.dir/131/files/2022/09/nrc-het-uur1280x768v0122072022.png)
:format(jpeg):fill(f8f8f8,true)/s3/static.nrc.nl/taxonomy/30cc870-Sluimer%2520Sarah%25202026%252001_1280.png)
/s3/static.nrc.nl/wp-content/uploads/2026/11/13110625/131126CUL_2038561817_ZAP_Den-Haag.jpg)
