'Medical record snooping' eroding public trust as health chiefs urged to act

Senior health leaders must do more to tackle “medical record snooping”, which is eroding public trust, an independent watchdog has said.

The Information Commissioner’s Office (ICO) has warned that staff viewing medical records without a legitimate reason is harmful, in a letter sent to more than 200 senior health officials across the UK.

Chief executive Paul Arnold has called for measures to be put in place to catch staff who access personal data, with the ICO already alerted to more than 300 unauthorised breaches so far this year.

A serious data breach was uncovered related to the death of Minnie Merriman in August.

The nine-year-old was seriously injured near an industrial estate in Arbroath and was taken to Ninewells Hospital, where she later died. Her father, Christopher Rice, is due to stand trial charged with her murder.

In the days following her death, Minnie’s medical file was accessed by staff at NHS Tayside without a legitimate reason, prompting an investigation.

Accessing personal records is ‘not harmless curiosity’, says ICO

According to a freedom of information request obtained by STV News, the ICO has more than 120 open complaint cases regarding data breaches across all 14 Scottish health boards.

The ones with the most included Lothian at 19, Greater Glasgow and Clyde at 18, Grampian at 15 and Forth Valley at 14. Borders and Western Isles have no active cases.

The ICO is looking for health officials to ensure that access is granted, reviewed, and removed appropriately, and to detect suspicious access through effective monitoring and audits.

In addition, they want staff to be fully aware of the consequences of accessing records without proper authority and investigate any activity promptly.

Mr Arnold said: “Accessing someone’s health records without a legitimate reason isn’t harmless curiosity. It can cause enormous distress to patients and jeopardise the vital trust people place in our health service.

“I’ve written to chief executives across the UK asking them to personally assure me that their safeguards work in practice. Where they don’t, we expect organisations to put that right. This isn’t only about processes – it’s about driving the right culture and behaviours to make sure those processes are respected and followed.

“This message goes beyond the health sector: any organisation entrusted with people’s most sensitive information has a duty to protect it, and we will take action if they fall short.

“I strongly encourage leaders in every sector to ask themselves whether their safeguards would stand up to the same scrutiny.”