The UK’s Information Commissioner’s Office has issued a formal caution to a former healthcare worker who attempted to access the private medical records of Catherine, Princess of Wales.

Key Points

• The London Clinic reported a security breach in March 2024 involving an unauthorized attempt to access the Princess of Wales’s medical files.
• The Information Commissioner’s Office (ICO) investigated the incident under section 170(5) of the Data Protection Act 2018.
• Investigators found the former employee deliberately misused sensitive information and offered to disclose it for financial gain.
• The ICO concluded that the hospital itself committed no regulatory breaches and maintained appropriate standards of care.
• The Princess of Wales was treated at the London Clinic for abdominal surgery in January 2024 before later announcing a cancer diagnosis.

Why it Matters

This incident highlights the critical vulnerability of high-profile patient data within private healthcare facilities and the legal consequences of violating medical confidentiality. It underscores the importance of strict internal data controls to prevent employees from exploiting sensitive information for personal or financial gain.