At least 30 health trust staff have been investigated for suspected snooping on the health service’s £400m digital patient records system.
The startling details have prompted a warning that patients “must have confidence” that their records are secure from prying eyes in a new system that is already causing fresh financial concern over “spiralling” costs.
Details on the number of staff in each trust that have faced investigation has been released under Freedom of Information (FoI) requests.
It follows the revelation in August that there had been over 40 incidents of “inappropriate access to patient information” on the supposed state-of-the-art system, which was switched on in 2023 with the aim of moving patient files from paper to digital and streamlining access to records for medical professionals.
The roll-out of the system across all trusts was completed in May 2025, and patients were advised that medical staff “will only access your information on a strict ‘need to know’ basis or when they are involved in your period of care”.
However, that has proved not to be the case, as all five health trusts have confirmed reported incidents of staff accessing records without permission.
After the Department of Health revealed over 40 reported cases in the summer, the Irish News submitted FoI requests to each health trust asking how many individual staff members have been investigated, and the outcomes in each case.
In the Belfast Health Trust, where there had been 16 suspected incidents, 17 staff have faced investigation.
Of those, five faced “formal disciplinary sanction”, while six still face “ongoing investigations”.
A number less than five faced “informal action”, while a number under five faced no further action.
A number less than five had their employment with the trust ended before an outcome of a probe.
The exact number in cases under five cannot be revealed under FoI legislation, the trust said, “as the small numbers involved could make patients personally identifiable”.
The South Eastern Trust revealed in its FoI response that nine individual staff have been “managed under the trust disciplinary procedure”.
In August, the trust confirmed nine access incidents were reported in 2024/25, and a figure fewer than five in 2025/26.
The Western Trust had two reported breaches that were reported to the Information Commissioner’s Office (ICO).
It can now be revealed that two trust staff were investigated – one for a suspected incident in 2025 and one this year.
Last year’s investigation was closed by the ICO “without any further action”, while the staff member linked to the 2026 incident is “currently progressing through the Trust’s disciplinary process”.
The Southern Trust said a staff number fewer than five have been subject to formal investigation.
“Where investigations have concluded, appropriate action was taken in accordance with the Trust’s disciplinary procedures,” the trust said.
The Northern Trust – where it emerged in the summer there had been eight reported incidents – also confirmed a staff figure less than five had faced investigation.
They did not confirm the outcomes of these probes, claiming the details “could be potentially matched up with other information to allow individuals to be identified”.
The Department of Health has said all healthcare staff “are contractually obligated to ensure that personal data is treated with the highest levels of confidentiality”.
“Procedures are also in place to deal with any suspected data security breach,” a spokesperson said.
However, the chair of Stormont’s health committee, Sinn Féin MLA Philip McGuigan, said the number of staff that have faced investigations is “deeply concerning”.
“Encompass has the potential to improve patient care, give staff timely access to the information and support a more joined up health service,” he said.
“Patients must have confidence that their sensitive medical information is protected.
“These cases must be thoroughly investigated, with appropriate action where wrongdoing is established. The Department of Health must ensure robust safeguards and effective monitoring are in place across every health trust.”
Encompass – which was £100m over budget – has also caused other problems for the health service, including around 12,000 items of patient correspondence disappearing from the system.
These included high priority “red flag” letters due to have been sent to patients.
Meanwhile, it has been warned the cost to run Encompass is “spiralling out of control”, with the required budget for this year rising from £15m to £35m.
Concern over healthcare staff accessing patient data without permission is also being reported in Britain, where a health trust has now sacked a total of 15 workers for accessing the records of the three victims fatally stabbed in the Nottingham attacks in 2023.
Meanwhile, staff at Yorkshire Ambulance Service are being investigated for suspected access of the records of William Chapman, the 24-year-old man who died after being mauled by a tiger when he entered its enclosure at Yorkshire Wildlife Park earlier this month.