NHS staff under investigation for accessing dead teen's medical records without permission

Paula McGowan learned something that deepened her grief. Ten years after her son Oliver died in a Bristol hospital, she discovered that at least five members of NHS staff had accessed his medical records without permission—some as recently as this year. Oliver was eighteen when he died in 2016, autistic, with a mild learning disability and epilepsy. He had received anti-psychotic medication despite his family's repeated warnings against it. Now, a decade later, his mother was being told that strangers had been reading the intimate details of his final days.

Three nursing staff are under formal investigation. A doctor who no longer works at Bristol Foundation NHS Trust has self-referred to the General Medical Council. Another staff member's case is being reviewed separately. When Paula requested information about who had accessed Oliver's records since his death, the trust told her that thirty-eight people had looked at the data. They had viewed six hundred and thirty-seven items and printed sixty-seven of them. Most of that access was legitimate—tied to complaints, legal proceedings, and the coroner's inquest into Oliver's death. But three nurses who had never been involved in his care could offer no professional reason for viewing his files. One nurse, according to Paula, said she had a general interest in anti-psychotic drugs and the care of patients with learning disabilities.

The trust is investigating thirteen additional cases involving former staff members—doctors, nurses, clerical workers—to determine whether their access was justified. Paula described herself as "deeply hurt, deeply disappointed." She told the BBC that Oliver's medical notes contained deeply personal information she had never shared with anyone. "He died in pain," she said, "and it's not pleasant if that side of Oliver's death has been accessed."

This case sits within a much larger pattern. A recent investigation by the Health Services Journal found that over the past five years, at least two hundred and fourteen NHS staff have lost their jobs for unauthorized access to patient records. Around two thousand more have faced sanctions. In July, Sir Jim Mackey, the head of NHS England, issued what he called a "stark warning" that staff could face dismissal or even criminal prosecution for snooping on sensitive data. High-profile examples have included victims of the Nottingham and Southport attacks and a child injured in a crocodile enclosure in Cambridgeshire.

Tom McGowan, Oliver's father, pointed to a structural vulnerability. As more medical information moves to digital, cloud-based platforms, the risk of unauthorized access has grown. "It's a weakness in the system," he said, "and action needs to be taken now to tighten up controls." NHS medical records are not centralized. General practices, hospitals, and specialist clinics maintain their own systems and decide who can view what. The records themselves can contain extraordinarily sensitive information—test results, discharge summaries, prescription details, safeguarding concerns, risk assessments, and detailed notes from consultations between healthcare professionals. IT systems do keep an audit trail showing who accessed what and when, but the ability to prevent inappropriate access depends on how tightly each organization controls permissions.

Bristol Foundation NHS Trust said it was "deeply sorry" for any stress and anxiety caused and has voluntarily referred itself to the Information Commissioner's Office. Prof Steve Hams, the trust's chief nursing and improvement officer, stated that every patient and family has the right to expect their personal information to be treated with care, respect, and confidentiality. "Any concern that records may have been accessed without a legitimate reason is something we take extremely seriously," he said. The trust said that if misconduct is identified, appropriate action will be taken through relevant processes.

NHS England's response was unambiguous. Any instance of staff accessing records without valid reason would be "wholly unacceptable, a disgraceful breach of patients' trust and against the law." The organization reiterated that staff could face disciplinary action, including loss of employment and potential criminal prosecution. The investigation into Oliver McGowan's case remains ongoing, and the trust has not yet reached conclusions about all the access that occurred.