Crackdown on UK medical record snooping after staff reported sneaking 300+ times this year

The Information Commissioner's Office (ICO) in Britain has issued a stern warning to healthcare bosses following over 300 reports of staff accessing medical records without proper authorization this year. The ICO wrote to more than 200 senior health leaders across the UK, emphasizing the need for executives to personally confirm their organizations' efforts to prevent such snooping.

Reports of staff accessing records for curiosity or sharing private information with unauthorized parties have been received between January and mid-October 2026. ICO chief executive Paul Arnold insists that healthcare organizations must demonstrate safeguards in place to prevent unauthorized record access, including who can view patient files, monitoring of access, and consequences for those caught.

Health bosses are given until November 27 to respond with their actions to address the issue, with those failing to review their safeguards in the past six months given an additional three months to improve. The problem is not limited to hacking but also includes staff looking up unrelated individuals, which can cause distress to patients and undermine public trust.

Previous crackdowns have included NHS England warning employees of job loss or imprisonment for unauthorized record access and guidance on implementing access controls and audit systems.