More than 200 sacked in five years: NHS trusts told to suspend staff who snoop on records
What happened
On 25 September 2026, the head of NHS England wrote to hospital trusts across the country with a blunt message about patient records. Sir Jim Mackey, NHS England's chief executive, told trusts that staff who look at patient records without a proper reason are committing gross misconduct. That is the most serious category of workplace wrongdoing. He said those staff should be suspended while the case is looked into, and that in most cases dismissal would be the right outcome. In plain terms: if a member of staff is suspected of reading records they had no business reading, they should be taken off the job straight away, rather than left working while the investigation runs. The letter follows a case that has been in the news this week. Paula McGowan's son Oliver died in 2016. He was 18 and he was autistic. His death led to a change in the law on training NHS staff about autism and learning disability. This month, Bristol's NHS trust told his mother that several members of staff may have looked at Oliver's medical records without a reason, some of them as recently as this year. Three nurses are being investigated. The trust reported itself to the Information Commissioner's Office, which is the UK's data watchdog. This is not the first warning. In July 2026, NHS England ran a campaign for staff with the slogan "Don't let curiosity kill your career", and published guidance for NHS organisations on preventing unlawful access to records. The September letter sharpens that message into an instruction about what managers must do on the day a concern is raised.
Why this matters
Your medical record is one of the most private things about you. It can hold your diagnoses, your medicines, your test results, notes about your mental health, and details about your family. You do not get to choose most of what goes in it. You simply have to trust that the people who can see it have a reason to. That trust is not a nice extra. It changes how people behave. If someone worries that a neighbour who works at the hospital might read their file, they may put off going to the doctor, or leave something out when they get there. That is bad for them and, in the end, bad for everyone. There is a wider point too. The NHS is moving more records onto shared digital systems, so that a paramedic, a GP and a hospital doctor can all see the same information. That joining-up genuinely helps patients. It also means more people can technically open your file. The only thing standing between "can open it" and "should open it" is the rule, and whether the rule is enforced. It is worth being fair about scale. The overwhelming majority of NHS staff never do this. Most people working in the health service handle other people's private information carefully every single day, and find the idea of snooping as uncomfortable as you do. But because the harm to a single patient is so personal, a small minority is still too many.
What the evidence actually says
It helps to separate what is confirmed from what is still being investigated. What is confirmed is the instruction itself. Sir Jim Mackey has written to NHS trusts saying that unauthorised, inappropriate and unjustifiable access to patient records amounts to gross misconduct, that staff should be suspended while an investigation takes place, and that dismissal will be appropriate in most cases. Where the member of staff is a registered professional, such as a nurse or a doctor, they can also be referred to their regulator and can be struck off. NHS England's guidance says employers may report cases to the Information Commissioner's Office and to the police. Looking at records without a lawful reason can be a criminal offence, not only a sacking matter. On how common this is, the clearest figure comes from the Health Service Journal, which reported that more than 200 NHS staff have been sacked over the past five years for inappropriately viewing patient records, with around 2,000 others sanctioned in some other way, such as a written warning. Those numbers are large in one sense and small in another: the NHS in England employs well over a million people. One trust's figures show what a single case can involve. After staff at Nottingham University Hospitals NHS Trust were found to have looked at the records of victims of the 2023 Nottingham attacks without needing to, the trust confirmed in May 2026 that it had dismissed 11 members of staff, issued 12 final written warnings and two first written warnings. What is not yet settled is the Oliver McGowan case. Three nurses are under investigation, and reports say at least five healthcare professionals may have accessed his records. An investigation is not a finding. Nobody in that case has been found to have broken the rules, and it would be wrong to write as though they had. Finally, be clear about what has not changed. Unauthorised access was already against the rules, already gross misconduct under most trusts' own policies, and already potentially criminal. What is new is the national instruction on timing: suspend on suspicion, rather than wait.
Qurexa perspective
We think this is worth writing about honestly, because it applies to us too. Qurexa delivers prescriptions and supports people with taking their medicines. To do that, we necessarily handle information about what people have been prescribed. That is health information, and it deserves the same care as a hospital record. The principle in Sir Jim Mackey's letter is one we hold ourselves to: you look at someone's information because your job requires it for that person's care, and for no other reason. Not curiosity. Not because you recognise the name. Not because someone asked you about a relative. There is no version of "just having a quick look" that is acceptable. We are not claiming any special virtue. This is the basic standard for anyone handling health information, and patients are entitled to expect it as a minimum.
Practical advice
If you are worried that someone has looked at your records without a reason, there are real steps you can take. Ask the organisation first. Every NHS trust and GP practice has a data protection officer. You can ask them whether your record has been accessed inappropriately. NHS systems keep an audit trail, which is a log of who opened a record and when, so this is a question that can usually be answered. Put your concern in writing. An email or letter gives you a dated record of what you asked and when. Keep a copy. Use the complaints route if you are not satisfied. NHS organisations have a formal complaints process, and your local Healthwatch or NHS Complaints Advocacy service can help you with it, free of charge. Go to the Information Commissioner's Office if that does not resolve it. The ICO is the UK's independent data protection regulator. You can raise a concern with it directly, and it is free. Do not let this put you off seeking care. This is the important one. If you have a symptom that worries you, or you need a medicine review, the risk of not being seen is far greater than the risk of someone snooping. If privacy is a particular worry for you, say so to your GP or pharmacist, because there are sometimes things that can be done. If you work in health or care, the safest rule is the simplest one. If you cannot name the patient whose care requires you to open this record, do not open it.
What to know
NHS England has told trusts that staff suspected of looking at patient records without a valid reason should be suspended immediately, and that this counts as gross misconduct. Sir Jim Mackey's letter went to NHS trusts on 25 September 2026. It says dismissal will be appropriate in most proven cases, and registered professionals can also be referred to their regulator. The instruction follows reports that staff at a Bristol NHS trust may have inappropriately accessed the records of Oliver McGowan, who died in 2016. Three nurses are under investigation, and no findings have been made yet. More than 200 NHS staff have been sacked over the past five years for inappropriately viewing records, with around 2,000 others sanctioned, according to the Health Service Journal. The NHS in England employs well over a million people. Unauthorised access can be reported to the Information Commissioner's Office and the police, and can be a criminal offence as well as a sacking matter. If you are concerned about your own record, ask your trust or GP practice's data protection officer, put it in writing, and take it to the ICO if you are not satisfied. Do not let the worry stop you getting care you need. Sources: NHS England, "Preventing unlawful access to patient records" (guidance for NHS organisations), https://www.england.nhs.uk/long-read/preventing-unlawful-access-to-patient-records/ | Health Service Journal, "'Summary dismissal' warning for record snoopers", 25 September 2026, https://www.hsj.co.uk/policy-and-regulation/summary-dismissal-warning-for-record-snoopers/8124432.article | Health Service Journal, "Exclusive: Hundreds sacked for snooping on patient records", 2026, https://www.hsj.co.uk/workforce/exclusive-hundreds-sacked-for-snooping-on-patient-records/8124194.article | Nursing Times, "Three nurses investigated for looking at Oliver McGowan's records", 25 September 2026, https://www.nursingtimes.net/policies-and-guidance/three-nurses-investigated-for-looking-at-oliver-mcgowans-records-25-09-2026/ | NHS England, "NHS warns 'snooping' staff face sack or prison for inappropriate access of patient data", July 2026, https://www.england.nhs.uk/2026/07/snooping-staff-face-sack-prison-inappropriate-access-patient-data/ This article is for general information and does not replace advice from a doctor, pharmacist or other qualified healthcare professional. It is not legal advice. If you believe your records have been accessed without a lawful reason, contact the organisation's data protection officer or the Information Commissioner's Office.
Related articles
Six hours, not never: the ICU filter notice the MHRA issued today
The UK's medicines and devices regulator has issued a new safety notice to hospitals, and it is about timing. On 13 October 2026 the Medicines and Healthcare p…
Eight pages to a minister: what the data guardian says trust is worth
On 12 October 2026, the government published a letter about who should be trusted with NHS patient data. It was written by Dr Nicola Byrne, the National Data G…
Update: the tests came back, and it was not plague
This is a follow-up to a story we covered on 5 October, when nearly 200 people were being monitored after the death of a laboratory worker in Siberia. There has…