Hospital worker in Somerset shared patient records without permission

A hospital worker in Somerset shared screenshots of medical records with their partner without permission, affecting around 200 patients. The incident came to light after documents obtained by the BBC revealed another serious breach of patient confidentiality in the county, following a similar case involving the family of Nottingham attack victim Barnaby Webber.

The worker, who has not been named, accessed patients' records, including details of appointments and highly sensitive medical information, and then sent the screenshots to her partner. One affected patient told the BBC: "She went through my medical information, some of which was highly sensitive, and my son's, then sent screenshots to her partner. Where is the justice?"

The incident was reported to the Information Commissioner's Office and investigated by police. The woman resigned before any NHS disciplinary process was completed. Police said she made full admissions during an interview and was given a conditional caution rather than being prosecuted. In a statement, they said officers weighed up proportionality with the level of harm and an assessment of motive, concluding her actions were not malicious and there was no financial benefit.

Some of those affected disagree with that decision. One colleague whose records were accessed said they believed there should have been a prosecution. They also revealed the worker had found out someone was pregnant by accessing their records, and had looked at records of children whose parents had died to try to find out their cause of death.

The scale of the breach has raised wider questions about how NHS organisations report such incidents. While around 200 patients' records were accessed in Somerset, the trust's annual report records it as a single data security incident. In Gloucestershire, one trust reported 187 information governance breaches in a single year. Great Western in Swindon recorded 48, and North Bristol Trust reported three.

The BBC also spoke to a man who raised concerns about a possible breach involving his wife's care at Southmead Hospital in Bristol. After she was transferred there unexpectedly for cancer surgery, a healthcare worker known to the family appeared at her bedside, despite not being told where she was. The man said his wife was afraid because she is a practising Muslim and worried about her clothing and privacy. Southmead said it could not comment while investigating the complaint.

Campaigners say NHS staff often have the technical ability to view records beyond those they need for their job. They suggest that patients should be alerted via the NHS app whenever their records are accessed, so that unusual activity can be spotted quickly. The hospital in Somerset has apologised to everyone affected, but for some patients, questions remain about whether the punishment reflected the harm caused and whether the NHS is doing enough to prevent similar incidents happening again.