Health service leaders across the UK have been asked to give personal assurances that their organisations can prevent and detect staff accessing patient records without a legitimate reason.
The Information Commission’s Office (ICO) has written to more than 200 senior leaders, asking them to check that safeguards are working in practice. Its intervention follows hundreds of reports from health organisations about unauthorised access to sensitive information.
ICO chief executive Paul Arnold wants leaders to confirm that their organisations control access to records, monitor for suspicious activity, make staff aware of their responsibilities and investigate concerns promptly. Where wrongdoing is established, organisations should take appropriate action and consider the impact on the person affected.
The regulator is asking leaders to confirm that they have reviewed their approach in these areas during the past six months. Those who have not are expected to complete a review within the next three months. The request is for assurances and, where necessary, reviews; it does not establish that every organisation has already made changes.
What the reports show
More than 300 reports of unauthorised access from health sector organisations were received and assessed by the ICO between 1 January and mid-October 2026. The figure excludes reports that were still waiting to be assessed.
The reports include accounts of staff looking at records without a legitimate need, viewing information about people they know or sharing information with others. These are categories of reported conduct, not a finding that every report led to a confirmed breach or a criminal prosecution.
The figure also does not show how many people were affected or how common inappropriate access is across all health services. It describes the reports assessed by the regulator in a particular period, rather than a complete count of every possible incident.
Arnold warned that accessing someone’s health information without a legitimate reason can cause considerable distress and undermine trust. Patients may need to share highly personal details to receive care, making confidentiality an important part of their relationship with health professionals.
From access controls to investigations
One part of the request concerns who can see patient records. Access should be granted, reviewed and removed appropriately, so that the permissions attached to a role remain relevant as responsibilities change.
The regulator also wants effective monitoring and audit arrangements. An audit trail can help an organisation examine which accounts have accessed information and investigate activity that appears unusual. Monitoring is a way to identify possible problems; an unexplained access would still need to be examined before conclusions are reached.
Staff awareness is another part of the review. The ICO wants everyone handling records to understand what is expected and the potential consequences of accessing information without authority. Having access to a system for work does not itself provide a legitimate reason to browse the records of a friend, relative or other person.
When concerns arise, the regulator expects prompt investigation and proportionate action. It also stresses the importance of considering the affected person and keeping them informed. A suspicion is not the same as an established finding, and the appropriate response will depend on what an investigation establishes.
The ICO has powers to pursue criminal prosecutions over unlawful access to patient records under the Data Protection Act 2018. It can also take regulatory action where it finds problems with an organisation’s compliance. Those powers do not mean that every report involves a criminal offence or will result in enforcement.
Resources and accountability
The latest letter builds on advice issued to the health sector in June. The ICO says responses from leaders will inform its next steps, and it is working with organisations across the UK, including the National Data Guardian in England, on wider improvements.
Sir Ciarán Devane, chief executive of the NHS Alliance, said misuse of records was a serious breach of trust. He also called for clear and achievable standards, adequate resources and realistic timescales, while recognising wider pressures on NHS organisations.
His response highlights the practical challenge behind the assurances: leaders need confidence not just that rules exist, but that the systems and people responsible for applying them can support those rules. A review is an opportunity to examine the arrangements; the letter itself is not proof of their effectiveness.
People who are worried about the way an organisation has handled their personal information can ask it to investigate. If they remain dissatisfied with the response, they can raise a concern with the ICO.
