Record snooping and famous patients

Summary

• A medical record holds what a patient has told their doctors. The Caldicott principles, the rules for handling patient information in health and care, say staff should open it only on a strict need to know basis. Opening a record without that need is what NHS leaders call snooping.
• A patient with capacity decides who learns about their health, even when the public and the press want to know. Staff who open a record without a reason take that control away, whether or not they tell anyone what they saw.
• Royal and religious leaders have handled their own diagnoses in different ways.
  • The King announced his cancer on 5 February 2024. The palace said he shared it to prevent speculation, and in the hope it might help public understanding for people affected by cancer.
  • After abdominal surgery in January 2024 the Princess of Wales asked that her medical information stay private. She announced her cancer in a video released on 22 March 2024.
  • Pope Leo XIV told the crowd at the Sunday prayer in St Peter's Square on 11 October 2026 that he would have a small growth removed from his lung. After the operation the BBC reported that it was cancer.
• In March 2024 a newspaper reported that at least one member of staff at the London Clinic had tried to see the Princess's notes while she was a patient there. The Information Commissioner's Office (ICO), which enforces data protection law, said it had received a breach report.
• On 17 June 2026 the ICO said it had formally cautioned a now former healthcare professional over a breach the London Clinic reported in March 2024. It did not say which patient's record was involved.
  • The ICO described misuse of highly sensitive information and an offer to disclose it for financial gain.
  • A caution is a formal warning, and it does not count as a criminal conviction.
  • The ICO did not identify failings in the wider care that would meet its threshold for enforcement.
• Three people were stabbed to death in the Nottingham attacks of June 2023. In March 2025 the city's hospital trust said it was investigating concerns that staff may have inappropriately accessed the victims' records, and by October 2026 it had dismissed 15 staff.

Dig deeper

• Sir Jim Mackey, the head of NHS England, wrote to trusts and GP practices on 25 September 2026 that NHS England intends to take a zero tolerance approach.
  • Snooping is gross misconduct, behaviour serious enough for dismissal, in almost all cases.
  • Unless there are exceptional circumstances, employers should strongly consider suspending a suspect and removing their access to records.
  • Some reports said suspects would be immediately suspended, which goes further than the letter's wording.
• In July Mackey had warned that staff could face "disciplinary action, dismissal, referral to the regulator or even time in prison". The Health Secretary, Yvette Cooper, called the cases a "disgrace" in October 2026.
• The rules use public interest in a narrow sense, meaning a benefit to society strong enough to outweigh confidentiality.
  • The doctors' regulator says disclosure without consent can be justified in exceptional cases, such as where failing to disclose may expose others to a risk of death or serious harm. The test is for doctors deciding whether to share information to protect someone, and gives no cover for reading a record out of curiosity.
  • Section 170 of the Data Protection Act 2018 makes it an offence to knowingly or recklessly obtain or disclose personal data without the consent of the organisation responsible for it. Offering to sell data obtained that way is also an offence. A defendant who proves the access was justified in the public interest has a defence. The penalty is a fine only.
  • The Computer Misuse Act 1990 makes unauthorised access to computer material a crime. In the Crown Court, which hears the most serious cases, the sentence can be up to two years in prison.
• Dozens of staff in Liverpool viewed the records of Southport attack victims, and about 40 hospital staff viewed the records of a young child hurt in an accident. The Nottingham trust says it is bringing in a system to detect possible breaches.
• The King's statement made the case for openness, saying that sharing would prevent speculation. The Princess's weeks of privacy were filled with online conspiracy theories. In 2025 the Vatican issued medical bulletins throughout Pope Francis's five weeks in hospital with pneumonia, while Pope Leo announced his own operation before it happened.
• Patient data can also be lost to outsiders. In June 2024 criminals stole data from Synnovis, the company that runs blood tests for King's College Hospital.

Ethical issues

Interview questions

• What do you know about the reports that staff tried to see the Princess of Wales's medical records?
• A nurse reads a famous patient's record out of curiosity and tells nobody. What harm has been done?
• You are on placement and a famous footballer is admitted to another ward. A friend asks you to check why he is there. What do you do?
• What are the arguments for and against the public knowing about the health of a head of state or a religious leader?
• Should staff suspected of snooping be suspended before an investigation has finished?
• The ICO cautioned a former health worker who it said had offered to disclose medical information for financial gain. Was a caution the right response?
• How can a hospital keep records open to the staff who need them while stopping others from looking?
• Why might staff be tempted to look at the records of people in the news?