National Health Service (NHS): Who, specifically, has access to my medical records, and how to do they gain that access?

At present around 90-95% of GP practices are on one of two electronic patient record systems EMIS or SystmOne it's the latter I know the most about because I've been using it since 2006. Now assuming your GP practice uses SystmOne it is entirely possible for another user of SystmOne, for example district nursing, to register you as a patient with their service and all they would need is your NHS Number or your name and date of birth. Does this automatically give them access to your GP record? Not quite. SystmOne works on a reciprocal sharing model requiring, in this case, your GP to share your preference for sharing the record out and the district nurse service to record your preference for sharing in. Without a response being recorded at both ends neither side sees anything, of course you could opt not to share out from your GP or not to share in at the DN service which gives the same result. Now it is also possible for a clinician, or anyone else with the right access permissions, to override your consent and view your entire SystmOne record. Which might be not a lot if you've never accessed a service using that system and your GP isn't using it either. Now of course the registration of a patient isn't something that'd go entirely unnoticed especially if that person was out of area or didn't otherwise meet the criteria for the service in an obvious way such as having an adult registered with a school nursing service. The override I mentioned does a trigger an alert which in theory is then investigated by the responsible individual for that service who would then find that no referral had ever been received and that the patient shouldn't have been registered, they would then be obliged to notify you of this incident and the information commissioner. Hospital records are indeed predominantly held on paper, what is electronic is only accessible within that hospital and not something that would be readily accessible to other services unless they'd been setup with access specifically by the hospital which does happen if a service is provided within a hospital but the staff are employed by a different organisation. None of this should make you feel alarmed or concerned about inappropriate access. From my time working in primary care and with community services I can 100% tell you that they just don't have the time or the willingness to go randomly hunting through patient records for juicy gossip. When I worked in a podiatry service I'd deal with may a hundred different direct enquiries from patients which meant opening their records and confirming information, did I stop to read what had happened just because I felt like having a nose? I did not because it's just not worth it legally or most pressing in my mind it isn't worth the time because I've got other work to do. Now, compare this to a purely paper records system there is no way of knowing who opened what record and when, just doesn't exist because they're kept in filing cabinets to which probably all of the staff have access and will have any number of legitimate reasons for going in there. At least in an electronic record system, assuming they have audit functionality, if a complaint was raised it could be investigated and if staff had inappropriately accessed records it would be visible and short of them gaining access to the back end of the software impossible to hide that evidence. On to your second point about medical staff telling stories or anecdotes to their friends and families. It happens, will they give names and personal details? They'd be incredibly stupid to do so, but stupidity happens so it might. If you're a particularly obnoxious patient I wouldn't be surprised if all of the staff in that service had heard some sort of story about you, there are problem patients and it's important staff know about these people so it doesn't cause risks to the staff or the patient. Is it unprofessional to talk about patient's to your family or friends? Yes. Having said that have you ever worked in a customer/client/patient facing role where you didn't talk about them afterwards? Funny stories do happen, as do bizarre ones and people share them. I truly hope this doesn't make you any less trusting of the medical profession, in fact this should be the spark to empower yourself as to what system they use, does it communicate with other systems used by other services? Does it have an online element allowing you to book appointments, re-order prescriptions or view a summary of your record? And if you do hear medical staff discussing a patient, it doesn't hurt to let them know you can hear and that if it were you then hearing it discussed in public would be upsetting/embarrassing.