The Oxford University Hospitals NHS Foundation Trust (OUH) has been accused of inappropriately accessing the medical records of a maternity care campaigner, Rebecca Matthews. Matthews, who co-founded a campaign group raising concerns about maternity care at OUH, claims that senior doctors, midwives, and clerical workers at the hospital have accessed her confidential notes without a legitimate reason. This incident has raised serious concerns about patient privacy and the accountability of NHS staff.
A Pattern of Inappropriate Access
Matthews discovered the unauthorized access after submitting a subject access request, which revealed a log of every time an OUH staff member logged on to her electronic patient record since 2021. The document, spanning 201 pages, detailed numerous instances of access that appeared to lack a valid clinical reason. This is particularly concerning given that Matthews had not been receiving treatment from the trust for two years.
Two distinct periods of suspicious activity were identified. The first occurred in June 2024, shortly after Matthews launched her "Families Failed by OUH" campaign. A nurse accessed her records two days after the campaign's Facebook page went live, and two consultant obstetricians viewed her notes several weeks later, despite neither having been directly involved in her care. The second period coincided with a joint investigation by the New Statesman and Channel 4 News into OUH maternity services.
A History of Misconduct
This incident at OUH follows a string of similar cases across the NHS. In May, 11 NHS staff were sacked for inappropriately accessing the medical records of victims of the 2023 Nottingham stabbings, and dozens of staff in Liverpool faced disciplinary action for accessing records of victims of the July 2024 Southport attack. The unauthorized accessing of medical records is a crime under the Data Protection Act 2018.
A Culture of Accountability?
The trust's interim CEO, Simon Crowther, acknowledged the investigation into potential inappropriate access and emphasized the trust's commitment to patient confidentiality. However, Matthews and others argue that the trust has a broader accountability problem. Matthews believes she has been targeted due to her campaigning for safer maternity care, and she has experienced other forms of institutional harassment, including a six-page legal letter and the recording of a private meeting without consent.
The Impact on Patients
The unauthorized access to Matthews' records has had a profound impact on her and other families. Matthews feels a sense of betrayal and anxiety, and she no longer trusts OUH to provide her or her family with healthcare. This incident has also had a "chilling effect" on other families who have spoken out about poor care, potentially discouraging them from doing so in the future.
A Call for Action
The case highlights the need for robust measures to protect patient privacy and hold NHS staff accountable. Matthews has reported the suspected unauthorized access to regulatory bodies and the police, and she calls for a thorough investigation into the trust's handling of patient data. The trust's response, while acknowledging the issue, has not provided a clear indication of the extent of the problem or the actions taken to prevent further breaches.
In my opinion, this incident underscores the importance of transparency and accountability within the NHS. It is crucial to address not only the specific cases of unauthorized access but also the underlying culture that may enable such misconduct. Patients should be able to receive care without fear of their privacy being violated, and they should also be able to challenge the institution without fear of retaliation. The trust must take decisive action to ensure that patient confidentiality is respected and that those responsible for any breaches are held accountable.
