Patient confidentiality is fundamental to the trust between patients and their GP practice. Patients expect their personal information to be accessed only by those who have a legitimate reason to do so.

Modern clinical systems make information readily available to support safe and coordinated care. However, this also creates an important responsibility for practices to ensure that access is appropriately authorised, monitored and managed.

For Practice Managers, information governance is not simply an IT responsibility. It involves staff management, training, governance, risk assessment and the development of a culture in which confidentiality is understood and respected.

This guide explores how primary care organisations can prevent inappropriate access to patient records, identify potential concerns and respond appropriately when issues arise.

1. What constitutes inappropriate access?

Having technical permission to open a patient record does not automatically mean that accessing it is appropriate.

Staff should only access information where there is a clear, necessary and authorised reason connected to their work.

Potential examples of inappropriate access include:

• Looking at the medical record of a family member, friend or colleague out of curiosity.
• Accessing the records of a well-known individual without a legitimate work-related reason.
• Reviewing information unrelated to an individual’s duties.
• Using another person’s login credentials to access clinical information.
• Continuing to access systems after a role or employment arrangement has ended.

It is important to distinguish between deliberate misuse and accidental access.

For example, a member of staff might inadvertently open the wrong patient record. This should still be managed appropriately, but it is not necessarily evidence of deliberate misconduct.

Similarly, an unusual audit-log entry is not, by itself, proof that someone has acted improperly.

The practice should consider the circumstances objectively before reaching conclusions.

2. Understanding management responsibilities

Although information governance often involves specialist advice, responsibility for maintaining effective arrangements extends across the organisation.

GP partners and the organisation acting as data controller are accountable for lawful processing and appropriate oversight.

Practice Managers and line managers have an important operational role in ensuring that access arrangements, staff responsibilities and monitoring processes are properly managed.

This includes making sure that:

• Staff have access appropriate to their duties.
• Requests for new or amended access are authorised.
• Access is reviewed when staff change roles or leave.
• Training and awareness arrangements are maintained.
• Concerns can be reported confidentially.
• Appropriate processes exist for investigating potential misuse.

The Practice Manager does not need to become an information governance specialist. However, they should know who provides that expertise and how concerns are escalated.

3. Preventing inappropriate access

Prevention should be the starting point.

Practices can reduce risk by ensuring that access to clinical systems is based on individual responsibilities rather than convenience.

Role-based access

Staff should have access appropriate to their duties, applying the principle of least privilege.

A receptionist, clinical pharmacist, GP, administrator and Practice Manager may require different levels of access depending on their responsibilities.

Access should be authorised, documented and reviewed periodically.

Particular attention should be given to temporary workers, locums, Additional Roles Reimbursement Scheme (ARRS) staff and colleagues who move between organisations.

Individual user accounts

Staff should use their own authorised accounts.

Shared logins make it difficult to establish who accessed information and undermine the effectiveness of audit trails.

Practices should ensure that access credentials are not shared and that staff understand their responsibility to protect them.

Starters, movers and leavers

Access arrangements should be included within the practice’s established workforce processes.

When someone joins, changes duties or leaves, there should be a clear mechanism for requesting, amending or removing access.

This is particularly important where staff have access to multiple systems or work across several practices.

Training and awareness

Information governance training should form part of induction and ongoing staff development.

However, completion of a training module should not be the only measure of understanding.

Regular team discussions and practical examples can help staff recognise situations where access would be inappropriate.

4. Monitoring access and identifying concerns

Prevention alone is not sufficient.

Practices should also have appropriate arrangements for reviewing access to patient information and identifying potential misuse.

Clinical systems may provide audit logs showing which users have accessed particular records and when.

A proportionate monitoring approach might include scheduled sampling alongside targeted, risk-based reviews.

When reviewing potentially unusual activity, practices should consider the wider context.

For example:

• Was the patient attending the practice?
• Was the member of staff involved in a legitimate clinical or administrative task?
• Was there a relevant appointment, telephone contact or workflow?
• Was the access consistent with the individual’s role and working arrangements?

An unusual access pattern may have a legitimate explanation.

Audit findings should therefore be assessed objectively, with appropriate information governance and HR advice where necessary.

Monitoring arrangements should be documented and conducted in accordance with applicable data protection and employment requirements.

5. Responding when concerns arise

If inappropriate access is suspected, the practice should have a clear and proportionate response process.

A useful framework is Prevent, Detect and Respond.

Prevent

Maintain appropriate access controls, individual user accounts, approved workflows, staff training and clear expectations.

Detect

Undertake proportionate audit checks, review unusual activity and assess potential concerns against relevant clinical and operational information.

Respond

Where a concern is identified:

1. Preserve relevant evidence, including appropriate audit information.
2. Escalate the matter through the agreed reporting route.
3. Involve the Data Protection Officer (DPO), information governance lead and HR support as appropriate.
4. Assess the circumstances, risks and potential impact.
5. Determine whether any formal notification or other action is required.
6. Document decisions, the reasons for them and any resulting learning.

The response should be fair, confidential and proportionate.

Not every incident will require external notification, but practices must assess potential personal data breaches against the applicable reporting requirements.

Where the threshold for notification to the Information Commissioner’s Office is met, the UK GDPR generally requires notification without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

6. Creating a culture of confidentiality

Policies and technical controls are important, but staff behaviour and organisational culture are equally significant.

Practice Managers can help reinforce confidentiality by ensuring that expectations are clear and discussed regularly.

Staff should understand that access to patient information is logged and may be audited.

They should also feel able to ask questions when they are unsure whether access is appropriate.

A useful message for team briefings is:

“Curiosity is human. Access is a choice.”

The key principle is straightforward: only access a patient record when there is a clear, necessary and authorised work-related reason.

Where staff are uncertain, they should seek advice rather than access information unnecessarily.

7. Five questions every Practice Manager should be able to answer

To assess your practice’s arrangements, consider the following questions:

1. Who authorises clinical-system access?

Can the practice demonstrate that permissions are appropriate and have been reviewed?

2. How quickly is access removed or amended?

Are there reliable arrangements for staff leaving, changing roles or completing temporary assignments?

3. Who reviews audit information?

Is there a named individual or team responsible for obtaining logs and assessing unusual activity?

4. Do staff understand the expectations?

Are colleagues aware that access is monitored and that inappropriate access may be investigated?

5. What happens when a concern is raised?

Is there a confidential reporting route and a clear, documented process for responding fairly?

If the answers are unclear, these are useful starting points for strengthening your arrangements.

8. Moving from policy to assurance

Having an information governance policy is important, but it does not necessarily demonstrate that the practice’s arrangements are working.

Effective management assurance requires evidence that access is controlled, changes are implemented, monitoring takes place and concerns are addressed appropriately.

This does not need to create an unnecessarily complicated administrative process.

Existing induction, HR, IT and governance arrangements can often be adapted to incorporate appropriate access checks and review processes.

The objective is to ensure that confidentiality is protected through everyday working practices, rather than relying solely on policies or reacting after something has gone wrong.

The question for practice leaders is not simply whether staff can access patient records, but whether they should, and how the organisation knows that access is being used appropriately.

Further guidance

This guide should be used alongside current NHS England information governance guidance, ICO guidance and relevant local policies.

Where concerns arise, practices should seek advice from their DPO, information governance lead and other appropriate professional advisers.