"Accessing someone's health records without a legitimate reason isn't harmless curiosity. It can cause enormous distress to patients and jeopardize the vital trust people place in our health service," ICO chief executive Paul Arnold said on Thursday as Britain's privacy regulator moved to tighten oversight of who reads patient files.
ICO demands personal assurances from more than 200 health leaders
The Information Commissioner's Office (ICO) has written to more than 200 chief executives and senior health leaders across the UK asking for personal confirmation that their organisations are doing enough to stop staff snooping through medical records. The regulator's three-page letter requires executives to explain who can access patient records, how that access is monitored, and what disciplinary or remedial steps are taken when unauthorised access is discovered.
Executives have until 27 November to respond. Those who have not reviewed safeguards in the past six months — or who conclude their protections are inadequate — have been given a further three months to put their house in order, the ICO said.
More than 300 reports of snooping in 2026, many rooted in curiosity
The ICO received and assessed more than 300 reports of medical-record snooping between January and mid-October 2026. The watchdog stressed that the figure covers reports submitted by healthcare organisations, not confirmed breaches, and excludes cases still awaiting assessment.
Descriptions of the reported behaviour include staff looking up people they knew, browsing patient files out of curiosity, and sharing private information with people who had no legitimate reason to see it. The regulator emphasised that much of the problem arises not from outsiders hacking systems but from employees who already have legitimate access using that access to view records of people they are not treating — neighbours, ex-partners, or individuals mentioned in the news.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildLegal and enforcement backdrop: prosecutions and the Data Protection Act 2018
The ICO has made clear it will not confine itself to letters. Over the past decade the regulator has prosecuted 16 healthcare workers for snooping through patient records; unauthorised access to personal information can amount to a criminal offence under the Data Protection Act 2018. Paul Arnold warned the ICO could also take enforcement action against healthcare organisations whose protections are not up to scratch.
Government statistics supplied to Parliament in July show that 1,445 cases of inappropriate access were reported to the ICO between 2019 and 2025, a figure regulators say illustrates the persistence and scale of the problem.
Technology and monitoring: audit systems, access controls and real-time flags
Health authorities have increasingly urged use of technical controls to limit and detect inappropriate access. In July, NHS England warned employees that accessing records without a legitimate reason could lead to dismissal or prosecution — and published guidance encouraging organisations to deploy access controls and audit systems to catch snooping.
Some newer electronic patient record systems can flag suspicious access in real time, the source reports. However, the NHS has acknowledged that monitoring capabilities vary depending on the technology organisations have installed, leaving inconsistent detection and response capacity across trusts and providers.
What this means for technologists, executives, and patients
- Technologists and security teams: Expect demands for clearer audit trails and for real-time monitoring features where possible; the ICO's letter explicitly asks who can access records and whether anyone is checking what they're looking at.
- Health executives and compliance officers: They must respond personally to the ICO by 27 November and, if they have not reviewed safeguards in the past six months or identify gaps, implement improvements within three months — or face potential regulatory action.
- Patients and the public: Regulators warn that unauthorised access causes "enormous distress" and undermines trust in the health service; the ICO expects organisations to consider whether patients should be told when snooping occurs and to take appropriate action against staff who breach rules.
The regulator's move places a tight timetable and a clear test at the feet of health leaders: demonstrate that access controls and monitoring work in practice, and that suspected breaches are investigated and acted on without delay. With hundreds of reports already filed this year and an established record of prosecutions, the ICO has signalled it will follow up on inadequate protections — leaving the next measurable moment as the collection of responses due by 27 November and any subsequent enforcement decisions.
