The UK Information Commissioner's Office (ICO) has called on health sector leaders to take action to end unauthorized access to medical records by their staff.

The ICO's Chief Executive has written to over 200 senior officials requesting personal assurance that effective prevention and detection measures are in place. This initiative, following recommendations made in June, is prompted by receiving over 300 reports of unauthorized access between January 1 and mid-October 2026. Reported incidents include accessing records without legitimate need, viewing records of acquaintances, or sharing information, which undermines public trust in the health sector.

The supervisory authority asks leaders to confirm that their organizations actively control access, monitor suspicious activities through audit systems, ensure staff understand the consequences of unlawful access, and take action in case of incidents. Officials must attest to having reviewed their procedures in the past six months or commit to doing so within the next three. The ICO reminds that it can initiate criminal proceedings against individuals under the Data Protection Act 2018, having already prosecuted 16 health professionals for such offenses over the past decade.