Just One More Look? When Accessing a Patient Record Crosses the Line

A patient attends the Emergency Department with chest pain. You assess them, arrange an ECG and blood tests, and hand them over at the end of your shift. Two days later, you are back at work and you remember the patient. I guess tricky cases are hard to forget?

“Was the repeat troponin positive? What did the CT angio show? Were they admitted under cardiology?”

…. So you open their record to find out, purely for academic reasons of course! It’s always useful to learn from a patient journey as a source of reflective practice. It might even make for a fantastic reflective log and something to discuss with your supervisor. Your reasons are educational as you were involved in their care. You want to know whether your clinical judgement was right.

But are you still entitled to access their record?

It’s common practice. This is why I thought I’d write about it today.

Having access doesn’t mean you have permission

This has become an increasingly important information-governance issue, particularly following NHS England’s announcement of a “zero-tolerance crackdown” on staff suspected of accessing patient records without a valid reason. Staff under suspicion are to be immediately suspended and locked out of NHS computer systems while the matter is investigated.

The announcement follows a series of high-profile incidents involving the records of patients involved in the Nottingham and Southport attacks, as well as other cases of potentially inappropriate access.

NHS England chief executive Sir Jim Mackey’s message was pretty unequivocal: anyone accessing records simply to satisfy their curiosity could ultimately lose their career and potentially end up with a criminal record. The important distinction here is that being technically able to open a patient’s record does not automatically give you a lawful or legitimate reason to do so.

Access for curiosity or personal interest can constitute unlawful access and, in serious cases, lead to disciplinary action, dismissal, referral to a professional regulator or criminal investigation. It can all escalate to this extent.

Whilst writing this, I referred to some of the guidance from our regulatory and professional bodies, including the GMC, RCP, RCEM and RCN. For example, the GMC puts the principle very simply: clinicians must not access a patient’s personal information unless they have a legitimate reason to view it.

These actions are all tracked. Electronic systems can record who accessed a record, when it was accessed and, depending on the system, what was viewed. Organisations are expected to monitor access and investigate unusual patterns and sometimes, you might have the nurse in charge pay you a visit.

But what about learning from your patients?

This is where the issue becomes more nuanced as clinical curiosity is part of medicine. You send somebody from ED to the medical team and wonder what happened. You refer a patient urgently and want to know the eventual diagnosis. You see an unusual X-ray or CT and want to look at it again. You may genuinely want to understand whether your original clinical judgement was correct.

NHS guidance recognises that there can be legitimate uses of patient information beyond immediate bedside care, including appropriately governed clinical follow-up, audit, quality improvement, education and training. However, there still needs to be a clear, necessary and authorised professional purpose, and access should comply with local organisational policies. “I wanted to learn from the case” does not automatically give you permission to access an identifiable patient’s record.

So consider three situations:

You treated a patient yesterday and need to review their results as part of an authorised clinical follow-up process =Potentially entirely appropriate.

Your department has an approved process for reviewing cases for teaching, audit or reflective practice =Again, potentially appropriate. Follow the agreed governance arrangements and use the minimum necessary identifiable information.

You remember an interesting patient and open their CT scan a week later simply because you want to see what it showed =That’s very different. “I’m interested” or “it would be educational” does not, by itself, create a legitimate reason to access identifiable records. This has to be said in no uncertain terms.

The RCN has highlighted exactly this problem. Concern about a former patient, wondering what happened after transfer, or wanting to learn from a case may feel understandable, but curiosity alone does not justify accessing confidential information. The reality is that Trusts and ICBs are clamping down on this, and the latest announcement from NHS England takes this considerably further.

What about accessing another organisation’s records?

The same principle applies. RCEM’s information-governance material on Summary Care Records emphasises the concept of a legitimate relationship with the patient and notes that access is auditable. NHS guidance similarly requires a legitimate relationship and appropriate permission or another justified basis for access.

This is particularly relevant as clinicians increasingly have access to information across different healthcare settings. You might be working in primary care and access hospital records to clarify what happened during an admission. Equally, you might be working in secondary care and access GP or shared records to understand a patient’s history. If that information is genuinely required for the patient’s current care, there may be a perfectly legitimate reason for doing so. Opening another organisation’s records later simply because you are interested in what happened is much harder to justify.

A useful test before clicking

Before reopening a record, ask yourself: “If the patient, my Caldicott Guardian or my regulator asked me tomorrow why I opened this record, could I clearly explain the legitimate work-related reason?”

If the answer is simply “I wanted to see what happened” ... Then don’t click!

I appreciate clinical curiosity is important. Following patients’ journeys can make us better clinicians. But learning needs to happen through authorised clinical follow-up, teaching, audit, reflective practice or other properly governed routes, not unrestricted access to identifiable records.

The biggest lesson from the recent NHS announcement is that this isn’t simply an abstract information-governance issue anymore. Access is logged, access can be investigated and under the new NHS approach, suspected inappropriate access could result in immediate suspension and removal of access to NHS systems while an investigation takes place.

Because in modern healthcare, “I was only having a look” may be much more consequential than it sounds.

Until next time..

Further reading: NHS England guidance on preventing unlawful access to patient records · RCN: Why inappropriate access to patient records is a professional risk · GMC confidentiality guidance

Originally published on Substack.