NHS staff keep snooping on NHS patients, including terrorism victims. “A disgrace” said the Health Secretary; the Information Commissioner called it a “worrying trend”. Those are only words, and the Department of Health in England is refusing to do what it can to prevent the problem in the first place.

Your NHS record can be read by thousands of staff, and you aren’t allowed to see who read your notes. There is no privacy, no transparency, and no trust. The NHS talks about response in high profile cases, but response only happens after getting caught. It does nothing to remove the reason the day to day creeping keeps happening. The officials who could change that simply refuse to.

The NHS exists to help people. Creeps keep creeping via “Inappropriate access” partly because A&E has to work, and pharmacies have to work, and the creeps, voyeurs and ghouls take advantage. The other part is that nobody can see them doing it.

The Department of Health in England acts as though staff creeping on patients is just a cost of doing business, the same way water companies dump sewage in the river.

Officials insist that there’s nothing which patients can do to know whether anyone creeped on them, or be reassured that their medical notes were not read by people who shouldn’t have looked.

The Department of Health in England treats the hospital as the victim, and neglects the patients as an inconvenience. The official message to patients is, in effect: please stop complaining about staff looking up your records (our guidance is here).

You are generally not allowed to know who has looked at your medical records. The Department of Health in England knows when and where your records are accessed. They keep track in a database. They simply refuse to tell you in the NHS App, because the decision makers know it is worse for them for you to see the abuses than not to see them.

Officials keep things hidden because they can, and because they expect no impact on the NHS from the cover-up, even if that means staff can go creeping without getting caught. The vast majority of the time, that’s what happens.

Computer systems allow abuses to be hidden in a way that’s impossible in the real world

Think of the hospital room. Think of the records like the chart at the end of your bed.

There is a very wide range of things that go on to keep hospitals working. You might not like the number of people, and one of them might be your friend from primary school, but if they’re your doctor or on your medical team they can explain why they’re there. They’re responsible and they’re doing their job.

Anyone who wants to look has to walk into your room, and talk to you about what they’re doing as they look at your chart. You’d expect your doctor to do that, but being a doctor doesn’t automatically make someone your doctor – they should introduce themselves.

Now consider the person you once went on a date with, slinking in, reading your chart, smirking a bit, and leaving without saying anything to you. That’s weird, and most NHS staff would find it abhorrent, whether in the hospital or via a computer.

That NHS staff provide care doesn’t mean they’re providing appropriate care to you. That they can access your record doesn’t mean they have an appropriate reason for doing so. Someone being a teacher at a primary school doesn’t make them a teacher at your child’s school, and it doesn’t entitle them to mark your child’s homework. Being a doctor doesn’t make them your doctor, and only your direct care team gives you direct care. Direct care is the difference between a skilled surgeon in the sterile operating theatre and a stranger walking in.

When a computer is involved, the Department of Health in England thinks that anything a member of NHS staff decides to do must be appropriate because an NHS employee or contractor does it, and the NHS will keep you in the dark. It is a deliberate and institutional failure of privacy, of transparency, and of trust.

And that’s why it keeps happening.

It will keep happening until every NHS staff member knows that if they look up a patient, the patient will see that it happened, and they would have to explain it to the patient the same way a doctor coming into your hospital room can tell you why they’re there. Suspension is a start for cases that come to light. A record of every access, visible to the patient in the NHS App, is what would change behaviour because every case would be visible to the person most interested in your medical records: you.

===

Find out what happens next: Sign up for our newsletter (we don’t email often) or get small frequent updates via Substack — free to follow, and we are grateful to all those who can donate to help more of this work.