University Hospitals of Liverpool Group: Medical Records
To ask His Majesty's Government whether the internal investigation by Liverpool Women’s University Hospital into inappropriate access to the medical records of victims in Southport examined (1) breaches using hospital systems to access the patients' GP records, (2) access to Summary Care Records, or (3) any access to the Liverpool Share2Care records.
Government answer
The unauthorised access of patients’ confidential information following the tragic events in Southport and Nottingham was unacceptable. It is essential that patients’ confidential information is only accessed appropriately, lawfully, and in line with their reasonable expectations.
As the investigation carried out by the Liverpool University Hospitals NHS Foundation Trust was internal, the Department does not have the detailed information requested.
The Nottingham Inquiry is also investigating the unauthorised access of data at the Nottingham University Hospitals NHS Trust. The inquiry will provide recommendations to ensure lessons are learned. We want to take steps to ensure that the culture within health and social care services, and the strong protections in law and various safeguards in the National Health Service, ensure that health and care information is used in a safe, secure, and legal way, and that this does not happen again.
NHS England is developing guidance which is focused on inappropriate access to patient records. The guidance will be aimed at NHS organisations and highlights the importance of ensuring that patient records are only ever accessed for legitimate purposes and any inappropriate access is likely to be considered a significant data breach. The guidance will be published in the coming months.