NHS suspends staff suspected of accessing patient records without authorization

NHS England's chief executive has ordered immediate suspension and computer lockout for staff suspected of improperly accessing patient medical records, implementing a "zero-tolerance" policy across all 205 English health trusts.

Sir Jim Mackey wrote to all trusts demanding the measures be introduced immediately, barring suspected staff from NHS computer systems to prevent further unauthorized access to confidential records, including from home. The directive applies to anyone suspected of viewing patient notes or medical histories without clinical justification. Mackey stated: "Patient records contain some of the most private information people will ever share. We have seen too many cases of people abusing that trust, and enough is enough."

The action follows multiple high-profile incidents in which NHS staff improperly accessed records of attack victims. These include patients affected by the Valdo Calocane attacks in Nottingham in 2023 and the Axel Rudakubana stabbings in Southport in 2024, as well as records of a child injured in a crocodile enclosure in Cambridgeshire. Most recently, Bristol Foundation NHS Trust launched an investigation after discovering that an 18-year-old's medical records had been accessed years after his death.

Data compiled from freedom of information responses show the scale of the problem. Between 2020 and 2025, 214 NHS staff were dismissed, three suspended, and 540 given final written warnings for inappropriate record access. An investigation by Sky News and the Health Services Journal found at least 214 NHS staff lost their jobs and around 2,000 others were sanctioned over the past five years. Documented cases include one employee accessing up to 179 patient records, another viewing a spouse's details in a potential domestic violence situation, and others sharing confidential information via WhatsApp.

The new policy addresses a longstanding gap: suspected staff have typically remained in post with computer access during investigations lasting days or weeks. Mackey warned staff: "Anyone who thinks they can satisfy their curiosity by looking at a patient's record should know this: they will be found out, they may lose their career and could end up with a criminal record."

The NHS also launched a national campaign reminding staff of their responsibilities and the serious consequences of unlawful access. Paula McGowan, whose son's records were accessed without permission, welcomed the commitment but called for "meaningful action" to follow. Paul Arnold, chief executive of the Information Commissioner's Office, has stated that inappropriate access "is rare and does not represent the behaviour of the vast majority of healthcare staff."