ICO warns health organisations about unauthorised access of patient medical records

The Information Commission (ICO) has warned UK health leaders to take immediate action to stop staff from accessing medical records without a legitimate reason, noting that unauthorised snooping threatens public trust in the health sector.

ICO Chief Executive Paul Arnold has written to more than 200 senior health service leaders, seeking personal assurance that effective safeguards are in place to prevent and detect inappropriate access. The warning follows more than 300 reports of unauthorised record access submitted by health organisations so far this year, in which personnel viewed records of acquaintances, accessed files without clinical need, or shared confidential details.

In the letter, Arnold calls on health leaders to personally confirm that their organisations actively control access to medical records, deploy monitoring and audit tools to flag suspicious activity, ensure staff understand what is expected of them and promptly investigate suspected unauthorised access when something goes wrong.

Senior executives must also confirm whether they have reviewed their organisational practices within the past six months, or commit to completing an evaluation within three months. 

The latest action follows a June blog article by Arnold discussing how unauthorised access to medical records jeopardises patient trust. 

Training Announcement: Freevacy offers a range of short one-day courses on a range of data-related subjects, including data protection topics such as how to handle SARs, conduct DPIAs, and implement privacy-by-design, as well as how to use AI tools responsibly, cybersecurity best practices, and information access. The interactive sessions cover basic concepts through to advanced examinations of specific areas. Find out more.