The ex-team clerk worked for an NHS Foundation Trust. She said that the “vast majority” of people who work for the NHS get given a special ID card that has to be slotted into a computer or laptop to access certain IT systems.
This is not just used by nurses, doctors and healthcare assistants, but admin staff too, she said.
Explaining how the system works, she added: “The idea of the card is that it leaves a trace so that if anything ever happens they know which person was logged into the computer.
“But once you’ve got a card you have access to the ‘NHS spine’ – the database of every single patient record. Once logged in – you have to have the card and the log in – it’s pretty much like a Google search to find a patient.
“Ideally you input the NHS number but you can search someone’s name – though it is harder to do this without date of birth or NHS number as people have the same name so you may click on the wrong ‘Fiona Callingham’ for example.
“But basically the bulk of NHS employees have access to everyone’s NHS records and it’s as simple as a good search to bring up the records.”
She stressed the seriousness of the situation, though.
“Searching the spine is a very serious and sackable offence. No one does it. During the training and induction you are repeatedly warned never to search anyone’s files apart from [your] patients but it is very easy to do,” she said.
“The news that a member of staff accessed Kate’s medical records made me realise just how easy it is for an employee to access them.
“I worked for the NHS for nearly two years and I had millions of patient files within my grasp.
“It is terrifyingly easy to go through the system – but to do so would be a major security breach and sackable offence.
“Staffers are repeatedly warned about how serious searching family or friends’ files is, bosses rely on trust that no one ever crosses the line.”
It is important to note that private hospitals such as the London Clinic may have different security and data systems to the NHS.
According to The Mirror, the Metropolitan Police has not confirmed whether it had been informed of the allegations.
But an Information Commissioner’s Office (ICO) spokesperson said: “We can confirm that we have received a breach report and are assessing the information provided.”
The London Clinic refused to comment on the claims but said: “We firmly believe that all our patients, no matter their status, deserve total privacy and confidentiality regarding their medical information.”