NHS England Orders Immediate Suspension for Record Snooping

NHS England chief executive Sir Jim Mackey has ordered every trust in England to immediately suspend and lock out of computer systems any staff member suspected of accessing patient records without a valid reason, according to a letter reported by BBC News. The measure, described by NHS England as a "zero-tolerance crackdown," takes effect at once and applies to every trust in the country.

What led to the crackdown

The policy follows a string of incidents in which staff viewed records of high-profile or vulnerable patients without authorization. The BBC's timeline of events includes:

• 2016 — Oliver McGowan, an autistic 18-year-old, dies at Southmead Hospital in Bristol after being prescribed anti-psychotic medication.
• 2023 — An NHS consultant in Cambridgeshire is investigated by the General Medical Council after accessing the health history of a woman who had started dating the doctor's ex-boyfriend.
• This month — A Health Services Journal investigation, cited by the BBC, finds that at least 214 NHS staff have lost their jobs and roughly 2,000 have been sanctioned for snooping on patient data over the past five years.
• This week — Bristol Foundation NHS Trust opens an internal investigation after learning the medical records of the now-deceased Oliver McGowan were accessed years after his death; at least five staff members at Southmead Hospital may have viewed his file as recently as this year.
• Today — Sir Jim Mackey writes to every NHS trust in England ordering immediate suspension and system lockout for any staff member suspected of unauthorized access.

The records of victims of the Nottingham and Southport attacks, and of a child injured in a crocodile enclosure in Cambridgeshire, were also accessed without authorization, according to the BBC report, contributing to pressure for a uniform national response.

What happens to staff who are suspected

Under the new instruction, any employee flagged for suspected unauthorized access will be suspended immediately and cut off from NHS computer systems, including remote access from home, pending investigation. "Patient records contain some of the most private information people will ever share," Mackey said, according to the BBC. "We have seen too many cases of people abusing that trust, and enough is enough. Anyone who thinks they can satisfy their curiosity by looking at a patient's record should know this: they will be found out, they may lose their career and could end up with a criminal record."

NHS England is also launching a national campaign to remind staff of their legal responsibilities around patient data, according to the BBC report. IT systems maintain an audit trail intended to show exactly who accessed a record and when, though the BBC notes there is no single NHS-wide electronic record system — GP practices, hospitals, and specialist clinics each maintain separate systems and set their own access rules.

How widespread is the problem

• At least 214 NHS staff have lost their jobs for snooping on patient data over the past five years, per the Health Services Journal investigation cited by the BBC.
• Roughly 2,000 staff have been sanctioned for the same conduct over the same period, according to that investigation.

Cases documented by the BBC range from staff looking up records of relatives, acquaintances, or ex-partners without authorization, to employees curious about the condition or care of a high-profile patient.

What the McGowan family is asking for

Paula McGowan, whose son Oliver died in 2016, told the BBC she was "deeply concerned and hurt" after learning that staff at Southmead Hospital may have accessed his records without permission as recently as this year. She said she welcomed the NHS's stated commitment to tackling the problem. Bristol NHS Foundation Trust said it is conducting a "thorough investigation" and that it would be "inappropriate to reach conclusions before those enquiries are complete," according to the BBC.

What to watch

• Whether individual trusts publish updated figures on suspensions carried out under the new policy.
• The outcome of Bristol NHS Foundation Trust's internal investigation into access to Oliver McGowan's records.
• Whether the General Medical Council or other regulators bring additional disciplinary cases tied to the broader pattern identified by the Health Services Journal.
• Whether NHS England moves toward a single, unified electronic records system, given that access controls currently vary trust by trust.

The full BBC News report, including additional case details, is available here.