Health leaders given three months to review safeguards against record snooping

The letter, addressed to chief executives and published by the regulator, says the pattern of recent incidents means the ICO now needs "greater assurance" that protections are operating effectively and consistently in practice. Arnold describes the legal and regulatory expectations as already clear.

He asks for assurance across four areas:

1. Effective access controls, with access to patient records granted, reviewed and removed appropriately
2. Effective monitoring, with audit arrangements capable of identifying unauthorised access and enabling it to be investigated
3. Regular and effective training, so staff understand when they may access patient information, why confidentiality matters and the potential consequences of unauthorised access
4. Consistent action when things go wrong, including prompt investigation, consideration of the obligations to notify the affected individual and the ICO, and disciplinary, professional or regulatory action where wrongdoing is established

Chief executives are asked to confirm that their organisation has reviewed its approach in these areas within the past six months. Where it has not, or where the chief executive is not satisfied with the arrangements, the review is to be completed within three months.

Health sector organisations sent the ICO more than 300 reports of unauthorised access between 1 January and mid-October 2026, a figure that excludes reports still awaiting assessment. Those reports cover staff viewing records with no need to, looking up people they know and passing information on.

Arnold said accessing health records without a legitimate reason "isn't harmless curiosity". In the letter he writes that the issue is "fundamentally a question of leadership and culture", while recognising the pressures on health organisations and the professionalism of the overwhelming majority of healthcare staff. He extended the message to every sector handling sensitive information.

The letter states that the exercise does not replace or alter organisations' statutory responsibilities to assess, report and respond to individual incidents, and is distinct from any existing complaints, investigations or other regulatory activity. Arnold adds that it is not intended to create another compliance exercise.

Individuals who unlawfully access patient records can be prosecuted by the ICO under section 170 of the Data Protection Act 2018, and 16 healthcare staff have been prosecuted in the last decade. Earlier cases relied on section 55 of the Data Protection Act 1998.

The letter says the ICO will take enforcement action in line with its Regulatory Action Framework where it finds evidence of problems with an organisation's compliance. Victims have a right to information and support through the Victims' Code and the ICO's right to review scheme.

The letter follows advice and good practice recommendations issued to the sector in June 2026. Arnold says the responses will shape the ICO's continued engagement, and the regulator is working on sector-wide improvements with bodies including the National Data Guardian in England.

In September, NHS England wrote to every trust in England to instruct them to immediately suspend any member of staff suspected of accessing patient records without a legitimate reason and to remove their access to NHS systems while the facts are established.