Pharmacist Warned for Repeated Data Breach of Ex-Husband’s Medical Records

Date of Decision: September 4, 2025

Registrant's Role: Pharmacist

Allegations:

Inappropriately accessed the medical records of her ex-husband on at least five occasions without clinical justification.
Accessed the medical records of family members based only on verbal consent.
Breached NHS and employer data protection policies.
Received a final written warning from her NHS employer.
Accepted a formal police caution for two offences under the Data Protection Act 2018.

Outcome: Warning issued by the GPhC Investigating Committee

GPhC Standards Breached:

Standard 5 – Use professional judgement
Standard 6 – Behave in a professional manner
Standard 7 – Maintain patient confidentiality and privacy
Standard 9 – Demonstrate leadership

Case Summary

Allegations

In this case, the registrant, a practising pharmacist, came under scrutiny after it was discovered that she had inappropriately accessed sensitive medical records without valid clinical justification. Specifically, she accessed the medical records of her ex-husband on at least five occasions and those of her family members, relying solely on their verbal consent. These actions were found to contravene both NHS information governance policies and the principles enshrined in the Data Protection Act 2018.

The inappropriate access to her ex-husband’s records was not isolated. The registrant accessed his medical data multiple times over more than a year—specifically on 08 July 2022 and 08 October 2023—without any professional need to do so. Furthermore, while accessing family members’ data with their verbal consent may seem less egregious, it still breached strict NHS and employer protocols around written consent and proper clinical justification.

Findings

The Investigating Committee of the General Pharmaceutical Council (GPhC) reviewed the allegations on 4 September 2025. They noted that the registrant had already faced internal disciplinary action by her employer, Lewisham and Greenwich NHS Trust, where she received a final written warning.

The situation escalated further when she admitted the conduct during a police interview, leading to a formal police caution on 22 May 2024 for two offences of unlawfully obtaining personal data, contrary to section 170 of the Data Protection Act 2018. This acknowledgment reinforced the seriousness of the misconduct and its clear departure from accepted pharmacy professional standards.

The Committee concluded that the allegations were substantiated, and the registrant had committed serious breaches in data handling and confidentiality.

GPhC Determination on Impairment

The GPhC’s Investigating Committee emphasized the broader implications of the registrant’s conduct, noting the damage it could cause to public confidence in the pharmacy profession. Pharmacists are entrusted with access to highly sensitive patient data, and any misuse of this access is taken extremely seriously.

While the registrant’s actions did not result in direct patient harm, the Committee focused on the principle of confidentiality as a foundational pillar of pharmacy practice. Breaching it, even in personal contexts, demonstrates a failure to uphold the integrity and professionalism expected.

“You are warned that accessing Patient Medical Records and any sharing of this information with no clinical need breaches patient confidentiality laws and privacy which should be maintained by pharmacy professionals, and that so doing undermines public trust and confidence in the profession.”

The Committee determined that although the registrant’s fitness to practise was not currently impaired to the extent that suspension or removal was necessary, the conduct warranted a formal warning as a clear regulatory response.

Sanction

Taking into account the nature of the misconduct, the GPhC Investigating Committee issued a formal warning. The decision reflects the seriousness of the breaches but also acknowledges mitigating factors, including:

The registrant’s cooperation during investigations.
Her admissions to the police.
The absence of direct harm to patients.
The internal disciplinary steps already taken by her employer.

This warning will remain published on the GPhC register for 12 months and serves as both a formal record of misconduct and a deterrent against future breaches.

Key Learning Points for Pharmacy Professionals

This case underscores the critical importance of maintaining professional boundaries and respecting patient confidentiality, regardless of personal relationships. Key takeaways include:

Patient confidentiality is sacrosanct: Even when dealing with family members or ex-partners, pharmacy professionals must not access records without formal consent and clinical justification. Verbal permission is not enough.
Know your data protection obligations: Pharmacy professionals must be familiar with and adhere to NHS and employer-specific data protection protocols. Breaches can lead to disciplinary action, criminal caution, and regulatory consequences.
Personal motives do not justify professional misconduct: Accessing records for non-clinical, personal reasons—even with no malicious intent—is still a violation of professional standards and the law.
Record-keeping and consent procedures must be rigorous: Documentation of consent is essential. Verbal consent should always be followed by written confirmation and proper logging.
Professionalism includes self-awareness: Knowing when to recuse oneself from accessing information that could be perceived as a conflict of interest is a hallmark of mature, ethical practice.

This case serves as a critical reminder that access to patient information is a privilege, not a right, and that even well-intentioned breaches can have serious repercussions. Pharmacy professionals must always ensure their actions align with both the spirit and the letter of data governance laws and professional standards.

Original Case Document

The full determination transcript is available to logged in users.