ICO chief executive Paul Arnold today wrote to over 200 senior leaders urgently asking for their personal assurance measures are in place and working effectively to prevent and detect staff prying into medical records.

Arnold said: ‘I've written to chief executives across the UK asking them to personally assure me that their safeguards work in practice. Where they don't, we expect organisations to put that right. This isn't only about processes – it's about driving the right culture and behaviours to make sure those processes are respected and followed.'

The letter builds on practical advice and good practice recommendations the ICO set out to the sector in June.

The regulator has received over 300 reports of unauthorised access from health sector organisations so far this year.

It is asking health leaders to personally confirm their organisations are:

• controlling who can see patient records, with access granted, reviewed and removed appropriately
• spotting suspicious access, using effective monitoring and audit systems to identify when records may have been viewed inappropriately
• confident that every member of staff knows what is expected of them and aware of the consequences of accessing medical records without authority
• acting when something goes wrong, investigating suspected unauthorised access promptly, considering the impact on the person affected and taking appropriate action where wrongdoing is established.

Leaders should confirm they have reviewed their organisation's approach within the past six months. Those who have not are expected to complete a review within the next three months.

Sir Ciarán Devane, chief executive of The NHS Alliance, said: ‘As digital technology becomes increasingly central to patient care, strong data governance is essential.

‘However, organisations need clear, achievable standards and the capability to meet them. Expectations around access controls, audit trails, monitoring and assurance must be supported by adequate resources, reflect what existing systems can do and be coupled with realistic implementation timescales.

‘There is also a risk in placing responsibility on individual leaders without recognising the wider organisational and system challenges many NHS bodies are already managing.

‘Maintaining public confidence requires both accountability and investment in the infrastructure, data governance and NHS expertise to prevent and respond to patient data safety.'

A spokesperson for NHS England said: ‘The NHS has introduced a zero-tolerance crackdown on staff who inappropriately access patient records and we welcome the support on this issue from the Information Commission's Office.

‘New guidance makes it crystal clear that NHS staff face immediate suspension as well as dismissal if they are found to have viewed confidential patient information without a legitimate reason.'