The UK data protection regulator has written to more than 200 health service chief executives, asking each one to personally vouch that staff cannot browse patient records without good reason. The regulator has logged more than 300 reports of improper access to health records this year.
What happened
On 12 November 2026 Paul Arnold, chief executive of the Information Commissioner’s Office (ICO), wrote to more than 200 top health service leaders spanning England, Scotland, Wales and Northern Ireland. The letter asks them for personal assurance that controls to prevent and detect inappropriate viewing of medical records exist and actually work.
The regulator says it received and assessed more than 300 reports of unauthorised access from the health sector between 1 January and mid-October 2026. Reports still awaiting assessment are excluded. The ICO lists the typical behaviour as staff opening records they have no clinical need to see, looking up people they know, and passing details on to others.
Leaders are asked to confirm they have reviewed four areas within the last six months: who can access records, how suspicious access is detected, whether staff understand the rules and penalties, and how incidents are investigated. Any organisation that has not done so is expected to finish a review within three months. The ICO says the replies will inform its next steps, and that it will take enforcement action where it finds compliance failings.
Arnold was blunt about the behaviour, saying in the ICO’s announcement that snooping “isn’t harmless curiosity”. He also widened the message beyond healthcare, urging leaders in every sector to test whether their own safeguards would survive the same scrutiny.
The detail
The letter builds on good practice advice the regulator issued to the sector in June, but it moves the burden from guidance to personal accountability. Chief executives, not information governance teams, are being asked to sign their names to the claim that safeguards work in practice.
The trigger is a run of distressing cases. LBC reports that 10 staff were suspected of viewing the file of Suffolk toddler Noah Woods after his death in September, and that two workers are believed to have accessed the file of William Chapman, killed by a tiger at Yorkshire Wildlife Park. In Scotland, STV News reports that NHS Tayside staff opened the medical file of nine-year-old Minnie Merriman without a legitimate reason in the days after her death in August. LBC adds that records of victims of the Southport and Nottingham attacks were also accessed inappropriately.
STV also obtained figures through a freedom of information request showing more than 120 open ICO complaint cases about data breaches at Scottish health boards, with NHS Lothian on 19 and NHS Greater Glasgow and Clyde on 18. Earlier this month, families affected by the Southport and Nottingham attacks and by maternity scandals signed a joint letter condemning the practice, according to LBC.
Organisations face enforcement under UK GDPR for failing to protect special category data. Individuals can be prosecuted under section 170 of the Data Protection Act 2018 for knowingly or recklessly obtaining personal data without the controller’s consent. The ICO says it has prosecuted 16 healthcare staff for such offences over the past decade. Separately, NHS England chief executive Sir Jim Mackey said in September that anyone suspected of snooping ought to be suspended straight away and lose their system access.
Why it matters for UK organisations
For NHS trusts, health boards, GP federations and private providers, this is effectively a compliance attestation with a deadline. A chief executive who signs off controls that later prove to be cosmetic will struggle to argue the organisation took appropriate technical and organisational measures if a case reaches enforcement.
The message also travels. Banks, insurers, local authorities, police forces, HR platforms and telecoms operators all give large numbers of staff wide read access to sensitive personal data. Arnold’s invitation to other sectors hints at where scrutiny may turn next. Insider misuse rarely triggers the alarms that external intrusion does, because the user is authenticated and authorised to open the application. That is exactly why it is so often missed.
There is a governance angle for boards too. The Cyber Governance Code of Practice expects directors to own risk, and this letter puts named executives on record. Expect audit committees to start asking for evidence rather than policy documents.
Expert view
In my experience, inappropriate record access is less a technology failure than an access model failure. Clinical systems are often configured with broad role-based permissions because care is unpredictable and nobody wants a locked screen in an emergency. That is defensible only if paired with strong detection after the fact. Too often the audit trail exists but nobody looks at it until a journalist or a family raises the alarm.
When we review access controls, the recurring problems are familiar: leavers and movers who keep permissions, generic or shared logins on ward machines, “break glass” functions used routinely with no follow-up, and audit logs retained but never analysed. Detection rules for this kind of misuse are not exotic. Flagging staff who open the record of a colleague, a neighbour or someone with the same surname, or who look up a patient in the news, is well within the capability of modern monitoring tools.
The ICO is right to stress culture. When colleagues snoop without consequence, others learn it is tolerated. Visible, proportionate action does more to deter repeat behaviour than another annual training module.
My one reservation is that a letter, however firm, depends on honest self-assessment. The real test will be whether the regulator follows up on organisations whose assurances do not match their incident history.
What to do now
- Brief the accountable executive. If you run a health organisation, make sure whoever signs the reply has seen real evidence: recent access reviews, audit outputs and closed investigations, not just policy.
- Clean up access rights. Run a joiners, movers and leavers reconciliation against your clinical and records systems. This maps directly to the Cyber Essentials user access control requirements.
- Remove shared accounts. Individual logins are the foundation of any audit trail. Without them, investigations stall.
- Turn audit logs into alerts. Build rules for high-risk patterns such as staff viewing colleagues, family members, VIPs or patients in the news, and review “break glass” use every time.
- Test the investigation process. Run a tabletop exercise on a snooping case, covering HR, information governance, professional regulators and how and when the patient is told.
- Refresh staff awareness with consequences. Make clear that section 170 is a criminal offence, and use anonymised outcomes to show the rules are enforced.
- Outside health, ask the same questions. Any organisation holding sensitive customer or employee data should check whether privileged read access is monitored at all.
Bottom line
The ICO has moved from advising the health sector to asking its leaders to put their names to the claim that patient records are protected from their own staff. With more than 300 reports this year and a three-month review deadline, organisations that cannot evidence working access controls and monitoring should expect closer scrutiny. Everyone else holding sensitive data should treat this as a preview.
Sources
- ICO: UK health sector warned to tackle medical record snooping
- STV News: ‘Medical record snooping’ eroding public trust as health chiefs urged to act
- LBC: NHS bosses warned records snooping is ‘putting public trust in health sector at risk’
- Nursing in Practice: Data protection regulator receives more than 300 reports of patient record snooping
