ICO blog post addresses inappropriate access to patient data in healthcare
On 22 June 2026, the Information Commissioner's Office (ICO) published a blog post by its Chief Executive Officer Paul Arnold, addressing the critical issue of inappropriate access to patient data within healthcare organisations. The post highlights that knowingly or recklessly accessing personal data without authorisation for whatever reason is against the law. It also recommends that quick and proactive communication with staff can prevent breaches when serious incidents occur.
The ICO Chief Executive Officer Paul Arnold's blog post, titled "Curiosity is not an excuse: protecting patient data in healthcare", notes that while inappropriate access to medical records is rare, recent high profile incidents in Nottingham and Southport indicate a worrying trend. These incidents underscore a cultural challenge within healthcare organisations. The post emphasises that staff often have legitimate access to systems for patient care, but this access does not equate to a legitimate need to view records for non care related reasons.
The ICO advises that simple leadership and organisational measures can significantly improve an organisation's culture regarding data protection. One key recommendation is quick and proactive communication from senior leaders to staff, clearly reminding them of their responsibilities towards patient confidentiality, especially when a serious incident is likely to attract public attention. Additionally, the post stresses the importance of role specific tailored data protection training to ensure every staff member understands precisely which records they are authorised to access and why. This training should be reinforced by appropriate technical controls such as access restrictions and audit logging, and staff must know how to report a breach.
The sensitive nature of health data and the broad access required for patient care consistently present challenges for data protection compliance, as seen in incidents like those in Nottingham and Southport.
ICO blog post
- Who this binds
- Healthcare organisations in the UK are bound by the UK GDPR and the Data Protection Act 2018, with the ICO's blog post providing advisory guidance on compliance.
- What changed
- The ICO's blog post clarified that knowingly or recklessly accessing personal data without authorisation is against the law, reinforcing existing legal obligations.
- What to check
- Organisations should review their internal communication protocols for high profile incidents and their data protection training programmes to ensure they are role specific and tailored.
- What this does not mean
- This guidance does not introduce new legal obligations or extend to sectors outside of healthcare, nor does it alter the lawful bases for processing patient data.
Send this to your team
The ICO's Chief Executive Officer Paul Arnold has published a blog post advising UK healthcare organisations to implement quick, proactive communication with staff during high profile incidents and to provide role specific data protection training to prevent unauthorised access to patient data.