GP practice staff snooping on patient records could face jail time, NHS England warns

GP practice staff and other NHS employees who access patient records out of ‘curiosity’ face dismissal or even prison time, NHS England has said. 

Chief executive Sir Jim Mackey said in a letter that accessing records was ‘wholly unacceptable’ and ‘a disgraceful breach of patient trust’. 

The letter was accompanied by new guidance which includes to staff across NHS, including GPs and their staff.

It comes after a series of reports of NHS staff being reprimanded or dismissed after inappropriately accessing health records of the victims of high-profile incidents. 

Sir Jim also said the ‘damage caused to public trust’ by these incidents threatened the development of the Single Patient Record, which will compel GPs to share patient data with it. 

The guidance highlights Pulse’s coverage of a 2017 case where a trainee medical secretary working in a GP practice who was fined for reading patients’ medical records for reasons unrelated to her job role.

Sir Jim said in his letter: ‘The majority of NHS staff handle patient information responsibly and professionally every day. However, a small minority of individuals undermine the trust that patients place in them and cause unnecessary distress and harm by accessing records without legitimate reason.

‘Aside from the harm caused, these staff members risk their own careers through disciplinary action, dismissal, referral to their professional regulator, and even criminal prosecution. 

‘Every time a breach occurs there is also inevitable and lasting damage caused to public trust in the NHS overall and, specifically, our ability to safeguard people’s data – something which is critical to the long-term future of the NHS as we design technology like the Single Patient Record.’ 

He added: ‘Anyone considering accessing records for personal reasons or out of curiosity should be in no doubt they could be putting their career at risk, and may face disciplinary action, dismissal, referral to the regulator or even time in prison.’ 

The guidance reminds staff that accessing records unlawfully could lead to dismissal for gross misconduct as well as being reported to the GMC, Information Commissioner’s Office (ICO) and the police.

‘People who do this have been prosecuted by the Police and the ICO under the Data Protection Act 2018 and the Computer Misuse Act 1990. Committing such offences can result in fines and prison sentences. You will also have a criminal record’, it says.

Meanwhile, the guidance for organisations states that electronic patient records must be designed to create a clear audit trail to show who has accessed health and care records.  

If an organisation does not have an automatic monitoring system, ‘you should have a process in place for manually checking access reports at regular intervals’, it says.

King’s Fund chief executive Sarah Woolnough welcomed the guidance and said ‘responsible handling of patient data’ would be key to the success of the single patient record.

She said: ‘Patients must be able to trust that their most sensitive personal information will be kept private and so it’s right that the NHS is taking firm action against ‘snooping’ staff who inappropriately access medical records. Sensitive health information should only be accessed by clinicians when there is a legitimate reason for it.

‘As ministers move forward with plans for a single patient record as part of the Health Bill, this and other efforts to digitise services present a major opportunity to deliver more joined-up care and information.

‘Done well, these reforms could help people take greater control of their health and navigate services more easily. To fully realise these benefits, however, public trust must be maintained through robust privacy safeguards and the responsible handling of patient data.’

It comes as the Health Bill, which is set to include legislation to create the Single Patient Record, is currently being debated in its committee stage. 

One amendment to the bill proposes preventing the establishment of the SPR ‘unless a plan to prevent inappropriate access by clinicians’ has first been published. 

Some GP leaders have also said there needs to be a wider consultation to define ‘appropriate’ access before the SPR is created.