Bristol NHS Foundation Trust said it was undertaking a “thorough investigation” and it would be “inappropriate to reach conclusions before those enquiries are complete”.
“Every patient and family has the right to expect that their personal information will be treated with care, respect and confidentiality,” said Prof Steve Hams, the trust’s chief nursing and improvement officer.
“Any concern that records may have been accessed without a legitimate reason is something we take extremely seriously.”
The trust said that, should any staff misconduct be identified, “appropriate action will be taken through the relevant processes”.
NHS medical records can contain highly sensitive personal information, ranging from test results and hospital discharge summaries to details of prescriptions and medications.
That extends well beyond the information available to patients through the NHS app and may include safeguarding concerns, risk assessments, correspondence between healthcare professionals and detailed consultation notes.
There is no single NHS-wide electronic record system that every member of staff can access.
Instead, organisations including GP practices, hospitals and specialist clinics maintain their own records and determine who can view particular information.
Doctors, nurses and other healthcare staff often need fast access, particularly in emergencies.
However, they should only view confidential information when they have a legitimate work-related reason and the right authorisation.
IT systems keep an audit trail that should be able to show exactly who accessed a patient’s records and when.
NHS England said any instance of staff looking at records without a valid reason would be “wholly unacceptable, a disgraceful breach of patients’ trust and against the law”.
“We have been crystal clear that staff could face disciplinary action for any breaches, including the loss of their job and potential criminal prosecution,” added a spokesman.