UK privacy regulator asks 200-plus health leaders for record safeguards
The Information Commissioner’s Office has asked healthcare leaders to personally confirm that protections against unauthorized access work, with responses due 27 November.
In this article
Information Commissioner’s Office (ICO) chief executive Paul Arnold wrote to more than 200 senior healthcare leaders across the UK on 12 November, asking them to personally confirm that their safeguards prevent and detect unauthorized access to medical records.
The request follows ICO advice to the healthcare sector in June 2026. Between January and mid-October 2026, the regulator received and assessed more than 300 reports of unauthorized access from healthcare organizations. The figure counts reports, not confirmed breaches, and excludes reports still awaiting assessment.
As The Register explains, staff who legitimately use a records system can still misuse that access to look up someone they are not treating. The reports also include staff viewing records of people they know and sharing patient information with others. Arnold said access without a legitimate reason can cause patients enormous distress and jeopardize trust in the health service.
What leaders must confirm
Leaders are asked to confirm that access is granted, reviewed and removed appropriately, and that monitoring and audit systems can identify suspicious access and enable investigations. They should also ensure regular, effective training explains when staff may access information, why confidentiality matters and the consequences of unauthorized access.
The ICO also wants prompt investigations of suspected access, consideration of the effect on the person concerned and of obligations to notify that person and the regulator, and appropriate disciplinary, professional or regulatory action when wrongdoing is established.
Chief executives should confirm that their organization reviewed its approach within the previous 6 months. If it has not, or if the chief executive is dissatisfied with the safeguards, the review must be completed within an additional 3 months. Arnold separately said organizations must put ineffective safeguards right.
Enforcement and next steps
In July, NHS England warned that accessing records without a legitimate reason could lead to dismissal or imprisonment and encouraged access controls and audit systems. In September, it instructed trusts in England to suspend staff suspected of such access and remove their system access while the facts were established.
The ICO exercise is separate from existing complaints and investigations and does not replace organizations' duties to assess, report and respond to individual incidents. The regulator said it will take enforcement action under its framework where it finds evidence of organizational compliance problems. Individuals who unlawfully access patient records can also be prosecuted by the ICO under section 170 of the Data Protection Act 2018.
People worried about how an organization has handled their information can ask it to investigate and raise a concern with the ICO if dissatisfied with its response. The regulator said leaders' responses will shape its next steps and continued engagement.
Share
Follow AveNews
Earlier in Technology
SoftwareThailand’s Transport Ministry orders aviation cybersecurity boost
The aviation authority has also instructed Thai Airways to contact affected passengers and advise them to change passwords and protect their booking details.
2 min
SoftwareUS wins authority to seize or restrain $1.2 billion in Binance theft
The November 12 authorization covers part of the assets frozen after the theft and permits a takedown of infrastructure used in a separate scheme targeting technology workers.
3 min
SoftwareAnthropic bans sustained, needless cruelty toward its models
The rule took effect on 12 November. Anthropic says it targets extreme, repeated cruelty with no discernible purpose, not ordinary frustration, pushback, dark creative themes, or model testing and research.
2 min
