A hospital worker at a Somerset NHS trust shared a screenshot of a patient's medical record with their partner. This individual also accessed up to 200 individual patient records without permission, according to new documents.
The breach by the Musgrove Park hospital worker was reported to the Information Commissioner's Office (ICO) in October 2023 and investigated by Avon and Somerset Police. The ICO supported "the allegation of unlawful obtaining of personal data" and concluded appropriate action had been taken, closing the case.
The worker resigned before any disciplinary action and received a conditional caution from Avon and Somerset Police. A spokesperson for the police said the woman made full admissions during an interview and officers concluded her actions were not malicious and involved no financial gain.
The inappropriate access spanned several years, with audit data showing records were accessed between August 2017 and October 2023. Those affected included patients, colleagues, friends, family members, and their partners.
Documents show the staff member had access to a single hospital system, allowing them to view demographic information, A&E attendances, admission details, wards, consultants, and outpatient appointments. The trust stated the system did not include clinical letters, discharge summaries, or separate records for mental health, community, or sexual health services.