This briefing summarises guidance issued by NHS England on stopping unlawful access to records (Stopping unlawful access to records guidance for health and care professionals – NHS England Digital)
Accessing health and care records out of personal curiosity or other unauthorised reasons is both unethical and illegal. It causes real harm to people accessing care and support services (and their families) and can result in dismissal from employment, a referral to the professional regulator and a criminal conviction.
Everyone working in health and social care services has a professional and legal responsibility to protect people’s confidential information. This includes only accessing a person’s records where there is a clear and legitimate reason to do so.
Access to a person’s records is lawful when it is for legitimate and appropriate work purposes. Access should:
In addition to delivering care and support directly to an individual, staff members may also need to access to records for other legitimate and authorised purposes. These include:
The guidance highlights different types of unlawful access including:
This is when someone views a record out of curiosity and not because they need to do so for their job.
This includes accessing the records of:
Personal curiosity is never a legitimate excuse for accessing an individual’s records. Even if there is no malicious intent, such actions are a severe breach of confidentiality, privacy and trust and will often cause significant distress for the person concerned and their family.
This occurs when someone uses their access to records for a personal reason which is not part of their job.
A common example is when staff members access their own records, or those of family or friends, to check assessments, progress with referrals or to look at test results.
Staff must not view their own record or those of family and friends unless it is part of an authorised work role and reflects agreed local processes.
In some cases, unlawful access can involve malicious intent, such as intent to cause harm. This could include stalking, harassment or causing distress to individuals.
Unlawful access may also occur when someone is allowed to access an individual’s record for a legitimate reason (for example, to provide care) but then uses it for a purpose that they are not allowed to use it for.
This is when a person purposely tries to look at a record they are not allowed to see but the system stops them, for example by blocking their access.
If a staff member accesses a record by mistake, that will not be unlawful access. For example, they might open the record of a person with the same name as the person they were looking for or mistype an identifier. If this happens, it is important to stop viewing the record as soon as the error is identified.
Unlawful access to records can have a significant impact on individuals and cause harm. People trust social care practitioners to keep their information safe, and breaches of confidentiality can leave people feeling deeply distressed.
Accessing records unlawfully could lead to dismissal from employment for gross misconduct, a report to professional regulators, the Information Commissioners Office (ICO) and the Police.
Accessing health and care records simply out of curiosity or for other personal reasons is illegal and a criminal offence. People who have done this have been prosecuted by the Police and the ICO under the Data Protection Act 2018 and the Computer Misuse Act 1990. Committing such offences can result in fines and prison sentences, and a criminal record.
If you have any concerns that a colleague has looked at a person’s case record when they shouldn’t have, you should report this to a manager, data protection officer or safeguarding lead. Alternatively, Whistleblowing processes can be followed (see Speak Up for further advice).
