Bristol Trust Investigates Staff for Snooping on Deceased Teenager's Records

Key points

• Bristol Foundation NHS Trust is investigating three nurses and one doctor for accessing Oliver McGowan's medical records without a legitimate reason.
• Oliver McGowan, an 18-year-old autistic boy with epilepsy, died in 2016 at Southmead Hospital in Bristol after receiving anti-psychotic medication.
• Paula McGowan, Oliver's mother, was informed that 38 people accessed his records since his death, with 637 items viewed and 67 printed.
• Most access was appropriate, linked to complaints, legal proceedings, or the coroner's inquest, but three nurses had no legitimate reason for viewing the records.
• One nurse allegedly accessed the files out of general interest in anti-psychotic drugs and care for patients with learning disabilities.
• A former doctor has self-referred to the General Medical Council, and the trust has voluntarily referred itself to the Information Commissioner's Office.

Background

This incident follows a series of high-profile NHS data breaches, including unauthorized access to records of victims of the Nottingham and Southport attacks. In July 2026, NHS England chief executive Sir Jim Mackey issued a stark warning that staff could face dismissal or prison for snooping on patient records. A recent investigation by the Health Services Journal found that at least 214 NHS staff lost their jobs and around 2,000 were sanctioned for snooping on sensitive patient data over the past five years. The McGowan case adds to growing concerns about the security of digital, cloud-based medical records, which contain highly sensitive information such as test results, prescriptions, and safeguarding concerns. Paula McGowan, who received an OBE in 2021 for her patient safety campaigning, has become a prominent voice in advocating for tighter controls on access to medical data.

Why it matters

This case underscores the critical importance of protecting patient privacy and the integrity of medical records in the NHS. Unauthorized access to sensitive data can cause significant emotional distress to families and erode public trust in healthcare institutions. The incident highlights the need for robust controls and accountability in managing digital medical records, especially as more data is stored on cloud-based platforms. It also reflects the broader challenges the NHS faces in balancing the need for fast access to patient information in emergencies with the imperative to protect confidential data. The zero-tolerance policy from NHS England signals a shift towards stricter enforcement and consequences for breaches, aiming to prevent future incidents and safeguard patient trust.

What to watch

Bristol Foundation NHS Trust will continue its thorough investigation into the 13 other cases involving former staff to determine if their access to Oliver McGowan's records was appropriate. If misconduct is confirmed, appropriate disciplinary action will be taken through relevant processes. The trust has already voluntarily referred itself to the Information Commissioner's Office. NHS England will likely monitor the outcome of this investigation as part of its broader zero-tolerance policy on unauthorized access to patient records. Paula McGowan and her husband Tom may continue to advocate for improved security measures and transparency in the handling of medical data. The case may also influence future policies and training for NHS staff on data privacy and ethical access to patient records.