Stopping unlawful access to records

This guidance explains what unlawful access to records is and what organisations can do to keep information safe and check who is accessing health and care records.

Introduction

Accessing health and care records without a clear work reason is unlawful. Being curious or concerned is not a legitimate reason to access a record as this can cause harm to individuals and damage trust. It can lead to staff being dismissed, referred to professional regulators and criminal prosecution. This includes people accessing records for reasons such as personal or professional curiosity, or directly accessing their own record or that of a friend or family member.

This guidance explains what unlawful access to records is and what organisations can do to keep information safe and check who is accessing health and care records.

Guidance for patients and service users

ARTICLE

Stopping unlawful access to records guidance for patients and service users

This guidance explains what unlawful access to records is, and what organisations can do to keep information safe and check who is accessing health and care records.

Guidance for health and care professionals

ARTICLE

Stopping unlawful access to records guidance for health and care professionals

This guidance explains what unlawful access to records is, and what organisations can do to keep information safe and check who is accessing health and care records.

Guidance for IG professionals

ARTICLE

Stopping unlawful access to records guidance for IG professionals

This guidance explains what unlawful access to records is, and what organisations can do to keep information safe and check who is accessing health and care records.

These IG pages provide clear and consistent IG advice and guidance to patients and service users, health and care staff and IG professionals. NHS England convenes a working group to check and challenge the guidance.

Updates since original publication

Read the updates since original publication

August 2026

Guidance for health and care professionals

Following feedback, clarification and more detail has been provided in a new section on when it is lawful to access records, including for the following purposes:

reflective practice
resolving complaints, safety investigations and legal action
morbidity and mortality reviews
clinical audit and quality improvement
education, training and teaching
operational support for care
other legitimate work activities

Updates have been made to clarify what to do when mistakes are made.

Following feedback, the example used for incompatible purposes has been changed to be clearer about what is unlawful and what is lawful.

Some changes have been made to terminology for consistency.

July 2026

Guidance for health and care professionals

Clarification around accessing records for complaints, audits, reflective practice or other legitimate work activities.

Last edited: 14 August 2026 2:43 pm