Unauthorised access to health records: why punishment alone is not a patient safety strategy
Recent cases of inappropriate access to NHS patient records have rightly produced a forceful response. Yet if healthcare concentrates only on the person who accessed the record, it risks missing the design, governance and risk-management obligations that sit upstream of the breach.
The standard should be unambiguous
NHS England’s position is now explicit. In July 2026, it warned staff that accessing patient information without a legitimate reason could lead to dismissal, referral to a professional regulator, criminal prosecution or imprisonment. Its September 2026 letter adopted a “zero tolerance” posture and asked trusts to suspend staff and remove their system access immediately where inappropriate access is suspected, while the facts are investigated.
That seriousness is justified: health records contain some of the most private information people will ever disclose. Curiosity does not create a lawful purpose. Familiarity with a patient, personal concern or public interest in a case does not create a care relationship. Deliberate access without justification can be a profound breach of trust.
This article is not an argument for a no-blame response. There are actions for which individuals should be held accountable. The question is whether punishment, on its own, amounts to an adequate control.
The evidence suggests this is not an isolated design problem
A joint investigation by the Health Service Journal and Sky News, reported in The BMJ in September 2026, identified at least 214 dismissals and around 2,500 cases resulting in sanctions or other outcomes among responding trusts since 2022. It also found that 30 trusts had not carried out a recent audit or had no proactive monitoring system, while others held no data or did not respond. The figures are incomplete and should not be treated as a prevalence study. Even so, they reveal a material variation in organisations’ ability to detect misuse.
High-profile incidents also show a recurring pattern: records connected with major crimes, traumatic incidents, children and public figures attract unusual attention. That pattern is important as foreseeable recurrence should change risk management. Once we know which contexts elevate curiosity, coercion or malicious intent, treating every record and every moment as if they carry equal risk becomes difficult to defend.
Digital access creates benefit and exposure at the same time
Electronic health records support safer and more coordinated care. Information can be available across settings, clinicians can make decisions with a fuller history, and patients may be spared repeated explanations. Human-centred design can help present the right information at the right time and reduce cognitive effort.
However, improved accessibility also expands opportunity. Where a paper file once required physical presence, digital records can sometimes be reached from many locations by large numbers of authorised users. The person may be authorised to use the system, but not authorised for that particular purpose or record.
This is the distinction at the centre of insider risk: possession of credentials is not the same as legitimate use. A 2026 PLOS Digital Health scoping review found that privacy literature is dominated by technical solutions, while practice also depends on organisational processes, staff experience, training, standardisation and workflow-specific controls. Secure digital care is therefore a socio-technical and human factors problem, not simply a staff-conduct problem.
The harm is not limited to embarrassment
It is easy to describe these events as privacy breaches and stop there. That language can understate what follows. A person may experience anxiety, shame, loss of trust and reluctance to disclose information needed for future care. Public confidence in the wider health service can also be damaged.
In some contexts, the potential harm is physical. A health record can contain contact details, a current location, pregnancy information, safeguarding notes, mental health history or evidence of abuse. The BMJ’s review of trust data included a case involving access to a spouse’s record in a potential domestic-violence situation. Information misuse can therefore intersect with stalking, coercive control and violence. The potential consequence must inform the strength and speed of the control.
A case reported on 21 October 2026 demonstrates why this issue cannot be reduced to curiosity or disciplinary statistics. Pippa Boardman was telephoned by a hospital employee she knew only vaguely and told that she had cancer, two days before her consultant confirmed the breast-cancer diagnosis. Royal Cornwall Hospitals NHS Trust said the employee had legitimate access to her records as part of their work, but that contacting her and discussing the diagnosis was outside their role.
The case matters because it sits at the boundary between authorised access and unauthorised use. A conventional permission model may correctly allow a member of staff to see information needed for their role, yet still be unable to prevent that information being used for an unrelated personal intervention. “They had access” does not answer whether the access, interpretation, communication or onward disclosure was legitimate in that context. This is precisely why just culture must combine fair individual accountability with system learning.
It also demonstrates that harm is not limited to the confidentiality breach itself. Boardman said she lost her dignity and privacy, found the disclosure invasive and intrusive, and felt the trust’s handling of her complaint reinforced the trauma. Life-changing information was delivered outside the planned clinical relationship and before the patient had the opportunity to receive it with appropriate explanation and support. This connects to the wider principle that listening, candour and compassion are patient-safety interventions, particularly when an organisation responds to somebody already harmed.
There are therefore at least three control questions. First, could access monitoring identify that the employee had no relevant relationship to the patient or no reason to revisit the result? Second, are staff trained not only in whether they may open a record, but also in the purpose limitations governing what they do with what they see? Third, when a patient reports misuse, is the response designed around candour, dignity and restoration as well as employment procedure?
The reporting does not disclose the disciplinary outcome or establish every detail of the employee’s purpose, so it would be wrong to speculate. What it does establish is the patient impact and the limits of a control model focused only on system permissions and retrospective punishment.
The Royal Cornwall case shows harm can begin with disclosure: good intentions do not remove responsibility for unintended consequences
The UK emergency-alert system illustrates the broader principle. The system exists to protect life. Yet domestic-abuse organisations warned that an alert sounding loudly on a concealed telephone could disclose the device to an abuser. Following the August 2026 wildfire alert, some charities again raised concerns about limited warning for people relying on hidden phones. Official GOV.UK guidance explicitly recognises that victims of domestic abuse may need to disable alerts on a concealed device.
This does not mean emergency alerts are a bad intervention. It means even a valuable intervention can redistribute risk. Human-centred design asks who may experience the system differently, what circumstances make harm more likely, and what mitigation is possible without destroying the principal benefit.
Digital health records require the same discipline. The intention is better care through better information. The obligation is to preserve that value while actively managing the exposure created by connectivity.
An organisational risk score can hide a changing risk profile
Risk registers often compress complexity into a score. That can be useful for prioritisation, but it can also create the illusion that the risk is flat and consistent. In reality, the aggregate rating sits above thousands or millions of individual records, each with a different combination of likelihood, attractiveness and consequence.
The risk around a record may rise because a patient becomes newsworthy, is involved in a major incident, is admitted alongside a member of staff who knows them, reports domestic abuse, or has another vulnerability that increases the potential consequence of disclosure. The risk may then reduce again over time.
This suggests a dynamic risk profile rather than a permanent “VIP list”. System owners should be able to identify time-limited triggers, apply proportionate safeguards and remove them when they are no longer justified. Employee and occupational-health records should sit within the same thinking. They may be held in more restricted systems, but where access exists, familiarity and workplace relationships can increase the impact of misuse.
What does the system owner owe the patient?
The ICO’s guidance on data protection by design and by default is clear that privacy must be integrated from the design stage and throughout the lifecycle. The Caldicott Principles require access on a strict need-to-know basis and use of only the minimum necessary information. NHS clinical-safety standards similarly expect manufacturers and deploying organisations to identify and manage hazards created by health IT and its use.
Together, these duties point beyond policy and training. A system owner should be able to explain: who can access which information; why that breadth is necessary; when permissions are reviewed; how unusual activity is detected; how quickly alerts are assessed; what additional protection can be applied when risk increases; how emergency access remains possible; and what evidence gives the board confidence that controls are effective. Promethean HD’s work on human factors in integrated digital records and making a safety case before harm occurs develops the same upstream obligation: the organisation creating or changing the risk must be able to explain why the design is acceptably safe.
“We tell staff not to do it” is an important part of the answer. It cannot be the whole answer.
A layered, risk-sensitive control model
No single control will solve inappropriate access. A defensible approach combines prevention, detection, response and learning.
Baseline access discipline. Use role-based or attribute-based access, least privilege, multi-factor authentication and effective joiner, mover and leaver processes. Permissions should reflect current work, not accumulate across a career.
Context-sensitive protection. Apply temporary heightened safeguards when identifiable triggers increase likelihood or consequence. Examples might include major incidents, intense media attention, credible safeguarding risks or requests from a patient where clinically and legally appropriate.
Safe emergency override. Restrictions must not prevent urgent treatment. “Break-glass” access can enable necessary care, but the override should be visible, time-limited and reviewed promptly.
Intelligent detection. Audit logs can identify who accessed what and when. More mature monitoring can look for patterns such as no apparent care relationship, access outside normal working context, repeated views, unusual volume, exports or access to a suddenly high-risk record. Alerts should explain why activity is unusual so reviewers can make informed decisions.
Rapid triage and containment. A detection control only works if somebody reviews the signal. Organisations need clear thresholds, trained reviewers, fair investigation and authority to remove access quickly where necessary.
Patient-centred transparency. Patients should be told how to raise a concern and what will happen next. Where systems allow it, accessible information about record access can strengthen trust, provided it is explained carefully and does not create confusion about legitimate multidisciplinary care.
Learning across organisations. Patterns from confirmed cases, false positives and near misses should feed back into system configuration, workforce education, risk assessment and national procurement expectations.
Why a blanket “reason for access” box may disappoint
Requiring a justification every time a record is opened has intuitive appeal. It inserts a pause, reminds the user of responsibility and creates data for review. In selected high-risk circumstances, it may be valuable.
Applied universally, however, it may become safety bureaucracy. Clinical staff may access records many times during an episode of care. A three-second task, repeated at scale, creates a considerable cumulative burden. Research on EHR usability consistently links poorly aligned data-entry requirements, fragmented navigation and workflow interruption with documentation burden, cognitive load and workarounds.
The control may also decay through habituation. If nearly every prompt accompanies legitimate work, users learn to dismiss it quickly. Standard answers become noise. Unless the organisation has the capacity and analytical method to review the reasons, it may collect more data without improving detection.
The better design question is where a justification materially changes risk. A targeted prompt could be triggered when there is no obvious care relationship, where a record has temporary enhanced protection, or when a user invokes break-glass access. That makes the friction proportionate and preserves its meaning.
The challenge to this argument
There are legitimate reasons to resist adding controls. Healthcare is complex, and access needs can be difficult to predict. Overly narrow permissions can delay care, especially across organisational boundaries or in emergencies. High false-positive rates can overwhelm information-governance teams and unfairly cast suspicion on legitimate clinicians. Additional prompts can increase workload and encourage workarounds. Malicious insiders are relatively rare, and no technical architecture can remove human choice entirely.
These are not arguments for doing nothing. They are arguments for careful design, piloting and evaluation. Controls should be tested against both privacy outcomes and care delivery. Measures should include false positives, time added, delayed access, reviewer capacity, staff workarounds, patient experience, confirmed incidents and time from anomalous access to containment.
The counterargument also reinforces the need for proportionality. If universal restrictions create new clinical hazards, a risk-sensitive model is preferable to indiscriminate friction.
Accountability is wider than blame
A just culture distinguishes human error, risky behaviour and deliberate misconduct. It does not excuse intentional abuse. Where somebody knowingly accesses a record without legitimate purpose, a serious sanction may be fair and necessary. The related Promethean HD article Beyond Blame examines how healthcare can preserve accountability while still learning from the wider system.
But systems thinking asks us to trace accountability across the whole control chain. The actor is accountable for the access. Managers are accountable for local standards and response. System owners are accountable for permissions and monitoring. Information-governance and cyber teams are accountable for translating risk into controls. Executives and boards are accountable for resources, oversight and assurance. Suppliers are accountable for providing usable security capabilities.
Accountability that stops at the user account is administratively convenient, but incomplete.
Why the national-record debate makes this urgent
The direction of travel is towards greater connectivity and more complete records. The benefits could be transformative: improved continuity, less duplication, better decisions and a more coherent experience for patients.
Yet connectivity changes exposure. A broader record can reveal more. A larger user base creates more possible routes of access. Shared infrastructure can increase the consequence of weak role design or inconsistent monitoring. None of this means that a national record should be rejected. It means the safety case must include misuse, insider risk, safeguarding and unintended consequences, not only availability and interoperability.
The strongest way to protect the opportunity is to confront the changed risk profile honestly. We need measurable privacy and safety requirements, meaningful user and survivor involvement, controls that adapt to context, and assurance that detection is active rather than theoretical. This should form part of a wider approach to healthcare governance, risk and assurance, not sit as an isolated information-governance concern.
Design for the world as it is
People do not become less human because a policy tells them to. Most will use access responsibly. Some will make mistakes. A small number will act through curiosity, self-interest or malice. System design should anticipate all three without obstructing the legitimate work of care.
Healthcare is right to say that inappropriate access can end a career. It should say, with equal clarity, that organisations will use what is already known to make inappropriate access harder, detect it sooner and protect those for whom disclosure could create the greatest harm.
That is not no-blame. It is risk management by design, not by luck.
Related Promethean HD guidance and insights
Compassion in the NHS: Why Listening Is a Patient Safety Intervention – How candour, dignity and compassionate response affect both learning and the experience of people already harmed.
A Listening Organisation Is a Learning Organisation – Why weak signals only protect patients when organisations are capable of hearing, testing and acting on them.
Beyond Blame: Can Healthcare Really Build a Just Culture When the Outside World Still Wants Someone to Blame? – Further analysis of restorative accountability, system learning and the fair treatment of individual conduct.
Safety cases in healthcare: can we make the case for safety before harm occurs? – A practical argument for making the evidence for safety explicit before major change is implemented.
Human Factors in Digital Healthcare: Designing Integrated Records for Success – A directly related exploration of integrated records, SEIPS, access risk and whole-system digital design.
What is Human Factors? – An introduction to designing tasks, technology, environments and organisations around real human capabilities and limitations.
Just Culture in Healthcare: Building Safer, Fairer and More Learning-Focused Organisations – Guidance on combining learning, fairness and proportionate accountability without confusing just culture with no blame.
Punishment tells people what happens after the boundary is crossed. Good design makes the boundary harder to cross, makes crossing visible and acts before more harm is created.
References:
7. Cobrado UN, et al. Access control solutions in electronic health record systems: A systematic review. Informatics in Medicine Unlocked. 2024;49:101552. Peer-reviewed systematic review of identification, authentication, authorisation and accountability approaches.
8. Kruse CS, et al. Security Techniques for the Electronic Health Records. Journal of Medical Systems. 2017;41:127. Peer-reviewed review of administrative, physical and technical safeguards.
Comments