UK NHS medical record snooping: ICO demands assurances after 300+ insider access reports in 2026
Severity: medium · Patch status: no-fix-needed · Since 2026-11-13
The UK Information Commissioner's Office has written to more than 200 senior health leaders after receiving over 300 reports of staff inappropriately accessing patient medical records between January and mid-October 2026. Staff used legitimate access to look up neighbours, ex-partners, acquaintances and people in the news, and shared private information improperly. Executives must personally confirm safeguards, access controls and audit monitoring are effective, investigate suspected breaches promptly, notify affected patients where needed, and take disciplinary action; responses are due by 27 November 2026, with three months to remediate where safeguards are lacking. The ICO warns it may take enforcement action against organisations with inadequate protections, and unauthorised access can be a criminal offence under the Data Protection Act 2018. NHS England issued similar warnings and guidance in July 2026.
What to do
- Review who can access patient records and enable/verify audit logging and real-time suspicious-access alerting on EPR systems
- Investigate suspected snooping promptly, assess whether patients must be informed, and apply disciplinary or legal consequences
- Implement role-based access controls limiting staff to records of patients they treat
- Respond to the ICO letter by 27 November 2026 with executive assurance; remediate within three months if safeguards are inadequate
Sources
All live incidents on Threat Watch
