The short version
- Bristol Foundation NHS Trust is investigating multiple staff members for potentially accessing the medical records of Oliver McGowan after his death in 2016.
- The family reports that dozens of individuals viewed hundreds of record items, with some accesses lacking legitimate clinical or legal reasons.
- This case occurs amid wider scrutiny of patient data privacy within the UK health system, where hundreds of staff have faced sanctions for similar breaches.
Bristol Foundation NHS Trust has launched a formal investigation into allegations that several employees accessed the medical records of Oliver McGowan without proper authorization. The inquiry follows disclosures to his mother, Paula McGowan, indicating that at least five staff members may have viewed sensitive data related to her son years after his death in 2016. The trust stated it is deeply sorry for any distress caused and has voluntarily referred the matter to the Information Commissioner's Office.
Oliver McGowan was an eighteen-year-old autistic boy with epilepsy who died at Southmead Hospital in Bristol. His death occurred after he was prescribed anti-psychotic medication during a seizure, which triggered a rare and fatal side effect. A 2020 report concluded that his death was potentially avoidable, citing failures in care and communication between medical staff and the family. The McGowans have since become prominent advocates for patient safety and improved care standards for individuals with learning disabilities.
According to information provided to Paula McGowan, thirty-eight people accessed Oliver’s records after he died. These interactions resulted in six hundred thirty-seven individual data items being viewed and sixty-seven documents printed. While the majority of these accesses were linked to legitimate activities such as complaints handling, legal proceedings, and the coroner’s inquest, a subset remains under scrutiny for lacking clear professional justification.
Three nursing staff members are currently under formal investigation because initial reviews could not establish a valid reason for their access to the files. One nurse reportedly expressed a general interest in anti-psychotic drugs and the care of patients with learning disabilities as a motive for viewing the records. A fourth employee’s case is being reviewed separately, while another former doctor has self-referred to the General Medical Council after being approached by the hospital.
The trust is also examining thirteen additional cases involving former staff, including doctors, nurses, and clerical workers, to determine whether their access to patient data was appropriate. Prof Steve Hams, the trust’s chief nursing and improvement officer, emphasized that every patient and family has a right to expect confidentiality and respect for their personal information. He noted that any concerns about unauthorized access are taken extremely seriously.
This incident reflects a broader pattern of data privacy failures within the National Health Service. Recent investigations indicate that at least two hundred fourteen NHS staff members have lost their jobs over the past five years due to snooping on sensitive patient data. Approximately two thousand additional employees have faced sanctions for similar misconduct. High-profile cases involving victims of violent attacks and other tragic incidents have drawn public attention to these vulnerabilities.
Sir Jim Mackey, head of NHS England, issued a stark warning in July that staff could face dismissal or even imprisonment for accessing records without legitimate professional reasons. The sensitivity of medical data extends beyond basic test results to include safeguarding concerns, risk assessments, and detailed consultation notes. These records often contain deeply personal information that patients do not share publicly.
Tom McGowan, Oliver’s father, highlighted the risks associated with digital health records stored on cloud-based platforms. He described unauthorized access as a systemic weakness that requires immediate action to tighten controls. Paula McGowan expressed deep hurt and disappointment upon learning about the ongoing investigation, noting that her son died in pain and that private details of his final days should remain protected.
The Bristol Foundation NHS Trust stated it is conducting a thorough investigation and will not reach conclusions until inquiries are complete. It affirmed that appropriate action will be taken through relevant processes if misconduct is identified. The case underscores the tension between necessary data sharing for legal and clinical purposes and the imperative to protect patient privacy from casual or unauthorized viewing.
As the investigation proceeds, the focus remains on determining whether specific staff members violated trust policies and professional standards. The outcome may influence broader discussions about digital security protocols within NHS trusts. For the McGowan family, the revelation adds a new layer of grief to an already traumatic experience, reinforcing their commitment to advocating for systemic improvements in healthcare delivery.
Sources behind this briefing
Go to the original reporting
- BBC News↗Mother of teen who died ‘deeply hurt’ that NHS staff may have accessed son’s records inappropriately
