Medical records confidentiality: why who has access matters

Last week, an NHS ambulance trust confirmed it was looking into whether two members of staff had viewed medical information about a young man who died at Yorkshire Wildlife Park, without any legitimate reason to do so. The trust picked up the concern through its own audits and has reported it to the Information Commissioner's Office. Our thoughts are with his family.

Sadly, it isn't the first case like this in 2026. But it's worth being clear about what kind of problem it is. Nobody hacked a system. The people involved had log-ins. What they didn't have was a reason to look.

That matters for everyone who handles medical records, including law firms and the providers they rely on. Medical records confidentiality depends on secure systems, but just as much on who can open a file, why, and whether anyone would notice.

What is medical records confidentiality?

Medical records confidentiality means a person's health information is only seen by people who have a legitimate reason to see it, and only for that purpose. Having access to a system isn't the same as having a reason to use it. Curiosity, concern or a personal connection never count.

How common is unauthorised access to medical records?

More common than the headlines suggest. A Sky News investigation found that almost 3,000 data breach cases had been investigated by NHS trusts in the last five years. The high-profile cases are simply the ones we hear about.

Those cases have still forced change. In July, NHS England published new guidance on preventing unlawful access, making clear that looking at records out of curiosity or for personal reasons is against the law. In September it went further, telling every trust to suspend staff straight away if they're suspected of looking at records they had no reason to see.

What does UK GDPR say about access to health data?

Under UK GDPR, health information is "special category" data. It carries extra legal protection, and organisations need a specific legal condition before they can process it. Looking at someone's records without a valid reason can also be a criminal offence under section 170 of the Data Protection Act 2018.

That offence isn't theoretical. In 2022 a former NHS worker was prosecuted and ordered to pay compensation after viewing the records of 14 people he knew personally.

Are law firms responsible for the medical records they share?

Yes. Clinical negligence and personal injury firms hold the same kind of information as the NHS, often in far greater volume, and they stay accountable for it when they pass it on. A single claim can involve thousands of pages covering someone's diagnoses, medications, family circumstances and treatment over many years.

Under Article 28 of UK GDPR, firms should only use processors who can give sufficient guarantees about security, and the confidentiality duty should reach every member of the provider's staff, including temporary and agency workers. The SRA's guidance on client confidentiality also expects firms to make sure outsourced information is properly protected.

Put simply, your client trusted you with their records. Every organisation you share them with becomes part of that promise.

What should you ask before sharing medical records with a provider?

A good provider will answer these without hesitation. If the answers are vague, that tells you something.

1. Who can see the records, and why? Access should be limited to the people who need it for the work.
2. Is access logged, and does anyone check the logs? The Yorkshire concern was found because someone was auditing. Logs only help if they're reviewed.
3. Where is the data stored, and how does it move? Look for UK-based storage, encryption in transit and at rest, and no reliance on email attachments.
4. Which accreditations do they hold, and what do they cover? ISO 27001 and Cyber Essentials are good signs, but check whether they apply to the whole service or just one part of it.
5. How do they meet UK GDPR? There should be a written data processing agreement covering confidentiality, security and what happens when the work ends.
6. How are staff trained? Policies only work if people understand them.
7. What happens if something goes wrong? Ask how quickly you'd be told. One Southport survivor wasn't informed that her records had been accessed until two years later.

How we think about it at MRC

We work with medical records every day, so none of this feels abstract to us. Behind every bundle is a person who never chose to have their history read by strangers, and who is relying on everyone involved to treat it with care.

Our Portal is hosted in secure UK-based data centres. Case files are shared through encrypted links with a separate password, and access is restricted to approved parties with full audit trails. Those controls matter, but they sit on top of a simpler principle: a record should only be opened by someone who needs to, for the purpose it was shared.

Key takeaways

• Most breaches of medical records confidentiality come from people who already have access, not from hackers.
• Health data is special category data under UK GDPR, and viewing it without a reason can be a criminal offence.
• Law firms stay accountable for records they share, so it pays to ask providers how access is controlled, logged and reviewed.

Frequently asked questions

What is medical records confidentiality?

Medical records confidentiality means a person's health information is only seen by people with a legitimate reason to see it, and only for that purpose. In the UK it is protected by UK GDPR, the Data Protection Act 2018 and the common law duty of confidence.

Is it illegal to look at someone's medical records without a reason?

Yes. Accessing medical records without a legitimate reason can breach UK GDPR and may be a criminal offence under section 170 of the Data Protection Act 2018. NHS staff suspected of doing so can now be suspended immediately while it is investigated.

Are law firms responsible for how third parties handle their clients' records?

Yes. A law firm usually remains the data controller for its clients' records, so it stays accountable when it shares them. It should only use providers who can show sufficient security guarantees, with a written data processing agreement in place.

What is special category data?

Special category data is personal information that UK GDPR treats as especially sensitive, including health data. Organisations need extra safeguards and a specific legal condition before they can process it.

Related reading: 9 questions to ask a medical record screening provider.

This article is for general information and isn't legal advice. Firms should apply their own professional judgement to their circumstances.