Jim Mackey has told NHS England’s 205 health trusts to suspend staff immediately if they are suspected of snooping on patients’ records and cut off their access to NHS systems. He said on Friday that anyone under suspicion should not stay in post while an investigation takes days or weeks.
He said patient records contain some of the most private information people will ever share and that there had been too many cases of people abusing that trust. He also warned that anyone who thinks they can satisfy their curiosity by looking at a patient’s record will be found out, may lose their career and could end up with a criminal record.
Jim Mackey and NHS England
Mackey wrote to all trusts demanding that they routinely implement a crackdown on breaching patients’ confidential data. He urged a zero tolerance approach to inappropriately accessing records and said staff found to have looked at notes or medical histories without a clinical justification should face a hardline response.
The change is aimed at the way investigations are handled across the NHS. Instead of leaving a suspected employee with access while facts are gathered, trusts are being told to move straight to suspension and system removal.
Oliver and Bristol NHS foundation trust
The pressure on NHS England has grown after breaches linked to high-profile cases and family records. Bristol NHS foundation trust apologised to Paula and Tom McGowan for staff snooping on the medical records of their son Oliver, who died in 2016 aged 18.
At least five members of staff, including three nurses and a doctor, accessed Oliver’s records without permission. That case put a family’s private history at the centre of a wider argument over how quickly suspected snooping should be stopped.
Data Protection Act breaches
The scale of the issue is larger than one case. Since 2020, more than 200 NHS staff in England have been dismissed and 2,000 others sanctioned for snooping on patients’ records, according to an investigation by Sky News and the Health Service Journal this month. Responses by 140 trusts showed 214 staff were dismissed, three suspended and 540 given a final written warning over the last five years.
Layla Moran called the official numbers for staff accessing patients’ records illegally under the Data Protection Act “canaries in the coal mine”. Paul Arnold said in June that “inappropriate access is rare and does not represent the behaviour of the vast majority of healthcare staff who take their duty of confidentiality extremely seriously”, even as health service bodies reported 1,445 cases of inappropriate access to the ICO between 2019 and 2025.
The immediate task for trusts is to turn Mackey’s instruction into routine practice across the NHS, because the system he describes depends on rapid suspension rather than waiting for an investigation to finish.
