Former NHS worker shared patient record screenshot with partner

A former hospital employee accessed up to 200 patient records without authorisation at Somerset NHS Foundation Trust between August 2017 and October 2023. The staff member who worked at Musgrove Park Hospital viewed sensitive files belonging to patients, colleagues, friends, and family members, including details of pregnancies, child bereavements, and A&E attendances. The individual also shared screenshots of medical records with their partner and used phone numbers obtained from hospital systems to contact a patient.

The staff member resigned before disciplinary proceedings and received a conditional caution after an investigation by Avon and Somerset Police. The officers determined that the actions did not involve malicious intent or financial gain. The Information Commissioner's Office (ICO) supported findings of unlawful data obtaining but closed the case without further regulatory action. BBC News reports that the affected victims expressed outrage at the outcome, criticising the lack of criminal prosecution for the extensive privacy violations.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.