If you have access to a patient’s records, you need a good reason to open them. Knowing someone, recognising their name or simply being curious is not enough. It sounds obvious, but recent cases in the news show that inappropriate access remains a problem across the NHS, and it is something pharmacy teams need to take seriously.
The consequences can be seen in cases involving some of the most distressing circumstances. Nottingham University Hospitals NHS Trust confirmed that 11 staff had been dismissed and a further 14 disciplined for inappropriately accessing the records of Nottingham attack victims Grace O’Malley-Kumar, Barnaby Webber and Ian Coates. In another case, employees at East Suffolk and North Essex NHS Foundation Trust were suspended or removed from active duty while investigations continued into unauthorised access to the records of three-year-old Noah Woods. These cases raise an obvious question: why are healthcare professionals looking at records when they have no legitimate reason to do so?
For families already dealing with devastating circumstances, the thought that someone might access their loved one’s medical information out of curiosity adds another layer of distress. Patient records are not public information, and working in healthcare does not give us an unrestricted right to look at them. A September 2026 investigation by the Health Service Journal and Sky News found that at least 214 NHS staff had been dismissed since 2022 for inappropriate access to patient records, with around 2,000 staff sanctioned. These figures should prompt the whole profession to reflect on how we handle confidential information.
As a pharmacist and healthcare lawyer, I think it is important to distinguish between having access to a system and having a legitimate reason to use it. The fact that a record is available at the click of a button does not mean that opening it is appropriate. Curiosity is not a clinical justification, and neither is the fact that you know the patient personally.
This is particularly relevant as the role of community pharmacy continues to expand. With services such as Pharmacy First and the growth of independent prescribing, pharmacists increasingly need access to relevant clinical information to assess patients, make treatment decisions and provide safe care. That access can be valuable, but it also brings greater responsibility. We must be clear about why we are accessing information and ensure that our use of it is justified by our professional role.
We also need to think about the records we hold ourselves. Patient medication records (PMRs) are central to everyday community pharmacy practice, helping us check dispensing histories, identify potential interactions, review medicines and support clinical decisions. Because these systems are part of our routine work, it can be easy to overlook the fact that they contain sensitive personal information. Having a patient on your PMR does not give you an unrestricted right to browse their history. Looking up a neighbour, friend or family member out of curiosity is no more acceptable simply because their information is held on your pharmacy system rather than another NHS record system.
So what should pharmacy teams do? The principle is straightforward: access records when there is a legitimate reason linked to patient care or another authorised function. Do not use workplace systems to investigate the health of friends, relatives, colleagues or public figures, and do not access your own records through work. If someone asks you to check their information, direct them to the appropriate route rather than assuming their request makes access acceptable.
Mistakes can happen, too. If you accidentally open the wrong record, do not attempt to conceal it. Follow your organisation’s reporting procedure and seek advice where necessary. Being transparent about an error is important, whereas trying to cover it up can make an already difficult situation worse.
Pharmacy owners and managers also have a responsibility to ensure that staff understand what appropriate access looks like. Policies and training matter, but so does effective monitoring and a culture in which mistakes can be reported promptly. Staff should understand that access may be audited and that inappropriate use of patient information can have serious employment and professional consequences, including fitness-to-practise proceedings.
As pharmacy takes on more clinical responsibility, we should welcome the opportunity to use patient information to improve care. But that information must be treated with the respect it deserves. Confidentiality is not simply about what we share with others; it begins with the decision to open a record in the first place. If you cannot explain why you need to access it, you should stop and think before clicking. Remember, “I was only having a look” is not a great defence.
Thorrun Govind is a pharmacist, healthcare lawyer, TV health expert and former Chair of the Royal College of Pharmacy in England.