ICO seeks assurances from healthcare leaders after 300 snooping reports

The Information Commissioner’s Office (ICO) has written to more than 200 senior healthcare leaders across the UK after assessing over 300 reports of staff snooping through medical records between January and mid-October 2026. The watchdog wants chief executives to confirm that safeguards are working, warning that unjustified access can harm patients and undermine trust in health services.

The 300-plus figure counts reports from healthcare organisations, not confirmed breaches, and excludes cases still awaiting assessment. The ICO wants leaders to explain who can access records, how access is monitored and what happens when staff are caught; they must respond by 27 November. Organisations that have not recently reviewed their safeguards, or find them inadequate, have three months to improve them. The ICO has prosecuted 16 healthcare workers for snooping over the past decade.