The consequences of improper access to patient records

Like most things in the digital age, medical records are now generally recorded and stored electronically. This relatively simple use of technology should generally allow healthcare practitioners to work more efficiently and help multi-disciplinary teams provide a more holistic approach to patient care with less delay. 

However, after several recent enquiries from healthcare professionals facing regulatory investigations and proceedings, it seems timely to remind those with access to confidential patient information that it should only be accessed for legitimate purposes because the consequences of doing otherwise can be far-reaching and career ending. 

When should someone access a patient’s records? 

Accessing records or personal data without consent or other appropriate justification is not only unprofessional and an obvious breach of patient confidentiality, but also illegal. If proven, such unlawful access or disclosure of personal information is considered to be data theft under the UK General Data Protection Regulations (UK GDPR) and can result in action being taken by the Information Commissioner’s Office.  

Whilst there will, of course, be exceptions such as when records are subject of a court order or access is required and approved for auditing purposes, the best advice, put simply, is that unless you are involved in the direct care of a patient, or the administration of that care, then there really is no reason why you should be accessing anyone’s medical records. 

Can I access my own patient records? 

Perhaps surprisingly for some, you are also likely to commit a criminal offence, if you access your own records held by your employer/the health trust. The reason being, it is they who are the data controller and so they effectively “own” the information, therefore accessing it without consent is illegal. 

It is, of course, perfectly normal for people to want to see their records but rather than a DIY job just because you can, the advice is to follow the same process as any other patient, which is usually by way of a subject access request. 

Will anyone know if I access patient records? 

Whilst it may be very easy to access records, it should also be remembered that it is just as easy for an IT department to find out who has accessed those records, not only that but they will be able to see when they were accessed and for what purpose.  

Who really cares if I just have a look at a patient’s records? 

By their very nature patient records can be extremely sensitive, therefore people quite rightly expect them to be treated in the strictest confidence, safe from unauthorised and inappropriate access. Any access by those who are not involved with a patient’s care not only breaches confidentiality but also risks undermining the entire system and the trust and confidence that people have in it. 

What are the consequences of unauthorised or inappropriate access to patient records? 

Unauthorised or inappropriate access will inevitably result in disciplinary action at a local level and quite likely at a regulatory level including before the GMC ; NMC or HCPC amongst others. Such proceedings could lead to suspension, dismissal or even erasure from the profession therefore the consequences of unauthorised/inappropriate use should not be underestimated. 

You may also find yourself facing criminal proceedings which can lead to significant financial penalties for not only the individuals involved but the Trust/employer.  

If you find yourself subject to an investigation or proceedings of this nature, you really ought to consider getting in touch with our experienced Professional Discipline lawyers. 

Top tips when it comes to accessing patient records 

• Be aware of your professional and regulatory obligations including those on the important issues of confidentiality and ethics; 
• Keep up-to-date with your workplace’s/local policies on the use of and access to patient records; 
• Never share your log-in credentials with anyone else (including colleagues); 
• Always remember to log out of computers/workstations/iPads, to avoid your credentials being linked to unauthorised access by others. 

How can Olliers help if you are under investigation? 

At Olliers our team of experienced professional discipline and regulatory lawyers have provided advice and assistance to professionals across all sectors and at all levels.  We understand the pressure and stress that an investigation and proceedings can place upon people and our specialist team have helped many clients navigate this difficult process. Our considerate and pro-active approach means that we are often instructed by doctors, nurses, pharmacists, dentists, healthcare professionals, amongst others. 

Whilst the team at Olliers are highly skilled and able to assist you at any stage of the disciplinary process, we would always advise you to get in touch with our experts at the earliest opportunity. 

Early instruction of a professional discipline lawyer benefits all involved.  A client will immediately have the benefit of legal advice and assistance and an additional support network in the form of their defence team. 

If you are also facing a criminal investigation, Olliers can assist you with both the criminal investigation and the often-parallel professional discipline proceedings. We will always seek to ensure that the strategy agreed upon during the criminal stage of proceedings does not jeopardise your position at a later stage before your regulator. 

Olliers Solicitors – specialist professional discipline lawyers  

Should you require assistance with any matter relating to access to patient records please contact our specialist professional disciplinary team to discuss how Olliers can assist. Please contact us by telephone on 0161 8341515, email us at info@olliers.com or complete the website enquiry form below.