18 trust staff accessed patient records wrongfully

More than a dozen cases of wrongful access to patients' records by staff have taken place at York and Scarborough Teaching Hospitals NHS Foundation Trust since 2021.

A Freedom of Information (FoI) request revealed that out of the 18 employees who wrongfully accessed medical records, eight cases were referred to the Information Commissioner's Office (ICO).

Paul Arnold, chief executive officer at the ICO, warned of a "worrying trend that requires a serious response across the healthcare sector" as a whole.

A spokesperson for the Trust said it took "patient confidentiality extremely seriously" and "any suspected breach of policy is thoroughly investigated".

No staff members at the NHS trust, which runs York, Scarborough, and Bridlington hospitals, were recorded as having been involved in more than one incident.

The FoI request, submitted by the Local Democracy Reporting Service, sought to ascertain whether any staff had been dismissed for unauthorised access to patient records.

However, the trust said it was unable to provide that information as "such matters are investigated on a case-by-case basis" and "in some cases, an employee may leave the trust before an investigation concludes, as a result, we are unable to provide an accurate year-by-year figure for dismissals relating solely to this issue".

The issue of wrongful access to medical records has received increased attention after staff at other NHS trusts in England were dismissed and investigated for inappropriately accessing the records of victims of the 2023 Nottingham attack and the Southport knife attack in 2024.

Arnold said the watchdog, which covers the UK, received a number of reports from organisations about breaches of this kind.

"Recent high-profile cases point not to isolated incidents but to a worrying trend that requires a serious response across the healthcare sector," he said.

"When a local incident becomes national news – a serious crime, a public tragedy, a story that captures widespread attention – there is an increased risk that healthcare staff could be tempted to look at records they have no reason to view."

Arnold explained there was a clear distinction between a legitimate need for medical information to provide care and "curiosity or more concerning motives".

Although most people understood this, in "rare cases" when information was wrongly accessed it damaged "the professional integrity of the many healthcare workers who do the right thing every day," he added.

The NHS trust's spokesperson said all staff were expected to "uphold the highest standards when accessing patient information".

"Access is permitted only when it is directly relevant to a patient's care, is closely monitored and audited, and any suspected breach of policy is thoroughly investigated."

They added: "Where inappropriate access is substantiated, appropriate action is taken, which may include disciplinary action or referral to professional regulators.

"All staff complete mandatory information governance training, with annual refresher training, and are regularly reminded of their responsibility to keep patient information safe."

Listen to highlights from North Yorkshire on BBC Sounds, catch up with the latest episode of Look North.