Police in Bristol have opened an inquiry after it emerged that staff may have accessed the medical records of Oliver McGowan, a teenager who died in 2016, without proper authorisation.

The investigation, announced by the West of England Police on Tuesday, focuses on whether NHS employees viewed the file after McGowan’s death, breaching the Data Protection Act 2018 and NHS confidentiality rules.

Accessing a deceased patient’s file without authorisation breaches both law and trust.

According to the BBC, the enquiry stems from a complaint lodged by a family member who discovered that the records had been consulted weeks after the coroner’s report was completed. Detectives are now reviewing system logs and interviewing staff who had clearance to the electronic health record system.

Investigation launched

Forensic IT analysts are examining audit trails on the NHS’s electronic patient record platform to establish who opened the file and when. The Information Commissioner’s Office (ICO) has been notified, and a senior data protection officer from NHS England has been assigned to oversee the probe.

Police have not disclosed the number of staff under scrutiny, but they have confirmed that any unauthorised access could constitute a criminal offence under the Computer Misuse Act.

Data protection rules under scrutiny

The NHS is bound by strict confidentiality obligations, reinforced after high‑profile breaches in 2022 that saw thousands of patient details leaked online. Those incidents prompted a £30 million investment in digital security and mandatory training on data handling for all clinical and non‑clinical staff.

Experts say that while access to a deceased patient’s record is permissible for specific purposes – such as legal investigations or post‑mortem reviews – it must be logged and justified. "The principle is clear: patient information remains protected even after death," a data‑privacy lawyer told the BBC.

Implications for patient confidence

Public confidence in the NHS’s ability to safeguard personal health information has been eroded by repeated scandals. A recent survey by the Health Research Authority found that 42 % of respondents were concerned about who could see their records.

If the investigation confirms a breach, the NHS may face a fine from the ICO and could be required to review its access controls across all trusts. The outcome could also influence upcoming reforms to the NHS’s data governance framework, slated for parliamentary debate later this year.

Families of patients who have lost loved ones often rely on the assurance that sensitive details remain confidential. The McGowan case highlights how a single unauthorised view can reignite broader anxieties about digital privacy in a publicly funded health system.

Authorities have urged anyone with information about the case to contact the West of England Police. The investigation remains ongoing, and further details are expected to emerge as forensic analysis progresses.