NHS worker secretly read ex-colleague's medical records

The Keele University campus
-Credit: (Image: Pete Stonier / Stoke Sentinel)


An occupational therapist who admitted accessing "confidential mental health information" about a former university colleague without authorisation has been hit with a six-month suspension. The Health and Care Professions Council (HCPC) made the order against Sarah Pritchard following a consent order hearing earlier this month.

She admitted accessing the private medical information of a former Keele University colleague - referred to as Service User A during the hearing - on April 22, 2021, as well as not informing her employer, North Staffordshire Combined Healthcare NHS Trust, as soon as possible about the data breach. As a result, Mrs Pritchard has had her registration suspended for a period of six months.

She can appeal the decision but it must be made within 28 days. The hearing was told that prior to her employment with North Staffordshire Combined Healthcare NHS Trust on March 8, 2021, Mrs Pritchard submitted a grievance against Service User A on her last day working at Keele University as a mental health adviser.

Prior to the outcome of the grievance which was being investigated by the university, she accessed and read the confidential medical records of Service User A on April 22. Five days later, the university determined the grievance against Service User A, upholding some of the complaints while dismissing others.

READ: Mum leads tributes after tragic death of 'larger-than-life' Royal Stoke worker Mother-and-daughter Pauline Sanders and Charmaine Whittaker worked together at the Royal Stoke University Hospital

READ: NHS crisis laid bare as Tobye pulls out tooth with pliers Tobye Spencer cannot get an NHS dentist - and it costs £800 to go private

The hearing was then told that on November 13, Service User A made a "subject access request" to North Staffordshire Combined Healthcare NHS Trust for information as to who had accessed the medical records. This information was provided six days later and on November 26, they registered a complaint with the trust. Service User A also notified the HCPC.

An investigation was launched and Mrs Pritchard admitted the breach. The trust’s information governance team was "satisfied there was no evidence" she had shared Service User A’s documentation with anyone else.

A recently-published report by the Health and Care Professions Tribunal Service, the fitness to practise adjudication service of the HCPC, outlines the findings and outcome of the hearing. It states: "The Trust commenced disciplinary proceedings against the Registrant on 16 December 2021 in respect of the breach of patient confidentiality. When interviewed on 12 January 2022, the Registrant admitted accessing the information and denied sharing it with anyone or using the information in any way.

"She was issued with a final written warning by the Trust on 8 February 2022, this warning was to remain on her record of employment for two years. The HCPC investigated the data breach concern referred by Service User A and, on 18 July 2023, an Investigating Committee Panel determined that the Registrant did have a case to answer in respect of the allegations set out above.

"The HCPC and the Registrant thereafter explored determining the matter by consent, ultimately agreeing that the matter was suitable for disposal by way of a Consent Order and suspension from the register for a period of six months. The Registrant signified her agreement to such a disposal by consent on 11 January 2024."

The report concludes: "The Panel was satisfied that the HCPC’s case was well founded in the light of the information and admissions before it. The Panel decided that accessing personal information about Service User A without clear clinical justification mounted to misconduct, which was admitted and accepted by the Registrant.

"The Panel also noted that the Registrant accepted that her conduct was dishonest and that she had provided a reflective piece addressing this element of the allegation, which was initially not admitted by her. The Panel noted that the Registrant accepts that she is currently personally impaired.

"It was satisfied that although she has demonstrated insight, remorse, and has undertaken steps towards remediation, her actions were serious enough that a finding of impairment based on the public component was necessary to protect service users and required to maintain public confidence in the profession."

A spokesperson for Combined Healthcare said: "We are unable to comment on individual cases. We are confident that all appropriate procedures and action was taken in regard to this incident."

Keele University declined to comment.

NEWSLETTER: Sign up for email alerts direct to your inbox