You may have read a couple of high profile stories in the media recently where NHS staff have been dismissed or disciplined for inappropriately accessing the records of patients. The cases in Nottingham and Liverpool are a reminder that unless colleagues are involved in the direct care of a patient, or the administration of that care, there is absolutely no reason why they should be accessing any healthcare record.
Not only is this wholly unprofessional and a clear breach of patient confidentiality, it is also illegal. Under the UK General Data Protection Regulations (UK GDPR), such unlawful access or disclosure of personal information is considered to be data theft and is a criminal act.
The Information Commissioner’s Office (ICO) has the authority to take action against individuals who have committed such an offence under the UK GDPR, which may lead to a substantial fine and prosecution.
Access to all electronic Trust systems that hold patient information is audited, so our IT colleagues can see who has accessed a patient record, when they have accessed it and what the purpose of that access was.
Healthcare information can be extremely sensitive and patients put their faith in us to look after and protect this information from unauthorised access. They are aware that various professionals within the Trust will of course require access to their healthcare record to provide them with the best care possible, but do not expect their record to be accessed by colleagues who are not involved with their care.
It is also a criminal offence for colleagues to access their own healthcare record held by the Trust. The Trust is the data controller and effectively “owns” this information and accessing it without consent is illegal. If colleagues would like to see their healthcare record they should follow the same process that is in place for patients, namely the data subject access request (DSAR) procedure.
A reminder on this topic, a thank you for colleague' support around Freedom of Information Requests and a reminder of our responsibilities around posting on social media are also covered in the latest IG Newsletter.