In response to more than 300 reports received from multiple health sector organisations this year relating to the unauthorised access to medical records, the Information Commissioner’s Office (ICO) has issued a communication to senior leaders across the sector seeking urgent assurance as to measures to tackle this issue. 

Earlier this year, the Information Commissioner issued advice to the sector on good practice to protect patient data as a result of recent high-profile cases of unauthorised access to records.

This further communication from Paul Arnold MBE, CEO of the ICO, goes further and now requires senior leaders to actively and personally satisfy themselves that their organisation is doing everything that it should to prevent, detect and respond to unauthorised access to patient records.  

The ICO recognises the importance of leadership and culture as critical to driving the right behaviours and ensuring the appropriate handling of patient records.  

Assurance is required across all areas of the handling of patient records:

• Effectiveness of access controls
• Effectiveness of monitoring of access
• Regularity and effectiveness of training
• Consistency of action when things do go wrong

Gerard Hanratty, Partner and Head of Health and Life Sciences at UK and Ireland law firm Browne Jacobson, said: “The ICO has indicated this action is not intended to impose new obligations on organisations or leaders, and is not intended to create a further burden. However, it does require that senior leaders confirm that their organisation’s approach has been reviewed within the past six months, and if not then to do so within the next three months.

“This exercise will inevitably involve dedication of resource from across various departments within organisations, particularly in light of the range of information management systems utilised by organisations, and is not an insubstantial exercise.  

“Senior leaders should take steps now to determine what has been done to date, and what further is required so that action can be taken as soon as possible and within the timeframes required by the Information Commissioner.”

Please contact Dmitirije Sirovica or Gerard Hanratty should you want to discuss what the ICO's expectations are and what you need to do to comply.