The Information Commissioner's Office (ICO) has issued a statement on the concerning trend of unauthorized access to medical records by healthcare staff.

Following high-profile incidents in Nottingham and Southport, the authority highlighted a worrying trend of unauthorized access to medical records, described as primarily a cultural challenge. Although healthcare staff often have legitimate access to systems for care purposes, the ability to view a record does not constitute a legitimate need to do so. Access out of curiosity, especially during high media coverage events, is illegal and can lead to disciplinary actions, loss of professional accreditation, and legal proceedings.

To prevent these violations, the ICO encourages healthcare organizations to implement preventive measures. These include proactive communication from management reminding staff of confidentiality obligations during high-profile incidents, as well as specific training tailored to each role. Appropriate technical controls, such as access restrictions and audit logs, should reinforce these rules. The authority collaborates with the English National Health Service and the National Data Guardian to support the sector.