Sir Jim Mackey has ordered NHS staff in England suspected of looking at a patient medical record without a valid reason to be suspended immediately and locked out of NHS computer systems. The step is meant to stop any further viewing of confidential records, including from home.
The NHS England chief executive said patient records contain some of the most private information people will ever share, and that too many people have abused that trust. He also warned: “Anyone who thinks they can satisfy their curiosity by looking at a patient's record should know this: they will be found out, they may lose their career and could end up with a criminal record.”
Sir Jim Mackey order
Mackey wrote to every trust ordering the measures to be introduced immediately. The move follows incidents involving the records of Nottingham and Southport attack victims, as well as an incident involving a child injured in a crocodile enclosure in Cambridgeshire.
Bringing suspension and system lockout together means a suspect can be removed from contact with records at once, while access is checked through the same systems that log who viewed what and when. The NHS said the approach is part of a wider crackdown that also includes a national campaign to remind staff of their responsibilities and the serious consequences of unlawful access.
Paula McGowan response
The latest action comes after Bristol Foundation NHS Trust said it had launched an internal investigation when the medical records of an 18-year-old were accessed years after his death. Paula McGowan told the she was “deeply concerned and hurt”.
That case put a family response at the centre of the issue. McGowan’s comments came as the NHS widened the response beyond one trust and toward every trust in England.
Audit trails and access
There is no single NHS-wide electronic record system that every member of staff can access. Instead, organisations including GP practices, hospitals and specialist clinics keep their own records and decide who can see particular information.
That structure means the lockout applies across separate systems rather than one national database. IT audit trails should still show exactly who accessed a patient’s records and when, which is the paper trail investigators can use when access is challenged.
Records and sanctions
This month, a Health Services Journal investigation found at least 214 NHS staff had lost their jobs over snooping on sensitive patient data over the past five years, while around 2,000 NHS staff had been sanctioned. It also found some staff were curious about a high-profile patient and wanted to know more about their condition or care, while others were struck off after looking up the medical records of relations, acquaintances and ex-partners without authorisation.
In 2023, an NHS consultant in Cambridgeshire was investigated by the General Medical Council after accessing the health history of a woman who had started dating the doctor's ex-boyfriend. Against that background, the new rule gives trusts a faster enforcement tool: immediate suspension first, access review second.
