Key Points
- Paula McGowan conveyed that she is extremely worried and wounded by the revelation that the medical files of her deceased son, Oliver McGowan, were probably being accessed improperly since after his death back in 2016.
- According to Jim Reed, a health reporter, and Matthew Hill, the West of England Health Correspondent of BBC, at least five people from Bristol Foundation NHS Trust had illegally accessed the information of Oliver as recently as this year.
- There are three nurses whose cases are being investigated, a doctor who used to work with the trust has self-referred himself to the GMC, and one more case from an employee is being investigated separately.
- After the trust received the request about the medical files, Paula McGowan was told that 38 individuals had accessed the documents since the time when her son passed away. In all, 637 entries had been looked at and 67 had been printed, but in most cases the access had to do something with the complaints, legal action, and the coroner’s inquest.
- One nurse wanted to look at the documents as she had an interest in antipsychotic medications and treatment of those who have a learning disability. Also, the trust has to investigate 13 more cases of viewing medical records by the previous employees.
- The trust has referred itself voluntarily to the Information Commissioner’s Office and apologized for causing stress and anxiety.
Bristol (Bristol Express News) September 24, 2026 — As reported by Jim Reed, health reporter, and Matthew Hill, West of England health correspondent of the BBC, Paula McGowan has said she is “deeply concerned and hurt” after learning that the medical records of her late son may have been accessed inappropriately for years after his death. Paula McGowan, whose 18-year-old autistic son Oliver died in 2016, was informed that at least five members of staff at Bristol Foundation NHS Trust may have accessed his records without permission as recently as this year.
As stated by Jim Reed and Matthew Hill of the BBC, three nursing staff members are under formal investigation, while a doctor who no longer works for the trust has self-referred to the General Medical Council. Furthermore, another member of staff is having their case reviewed separately. The trust noted that it was “deeply sorry” for any stress and anxiety caused and confirmed it had voluntarily referred itself to the Information Commissioner’s Office.
How Often Were Oliver McGowan’s Records Accessed After His Death?
Oliver, who had a mild learning disability and epilepsy, died in 2016 at Southmead Hospital in Bristol after being given anti-psychotic medication that his family had repeatedly warned he should not receive. Following a subsequent request for information about his medical files, his mother was told that 38 people had accessed the data since his death, with 637 items viewed and 67 printed off.
As reported by Jim Reed and Matthew Hill of the BBC, most of this access was appropriate and linked directly to complaints, legal proceedings, and the coroner’s inquest into his death. However, three nursing staff members not involved in his care are currently under formal investigation after initial inquiries could find no evidence they had a legitimate reason to view her son’s records. Paula McGowan stated that she was told one nurse wanted to view the files because they had a general interest in anti-psychotic drugs and the care of patients with a learning disability.
In addition, the trust is looking into 13 other cases involving former staff, including doctors, nurses, and clerical workers, to establish if that access was appropriate or not. One doctor who no longer works at the hospital has already referred themselves to the medical regulator after being approached by the institution.
Explore more Local Brsitol News:
Bathurst Bridge Reopens Early After Major Repairs in Bristol 2026
Search Continues for Missing Teenager George in Portishead 2026
What Did The Family And Hospital Trust Say Regarding The Breach?
Speaking to the BBC, Paula McGowan expressed that she was “deeply hurt, deeply disappointed” regarding the ongoing investigation. As quoted by Jim Reed and Matthew Hill of the BBC, Paula McGowan stated:
“I’ve always been open and honest but there are deeply personal things in Oliver’s [medical] notes that I don’t tell anybody. He died in pain and it’s not pleasant if that side of Oliver’s death has been accessed.”
Her husband, Tom McGowan, added that the risk of unauthorised access to medical records had increased as more information is stored on digital, cloud-based platforms, calling it a weakness in the system that requires immediate action to tighten controls. Paula and Tom McGowan became prominent patient safety campaigners following Oliver’s death and received an OBE in 2021 for their work to improve care for autistic people and individuals with learning disabilities.
In response, Bristol NHS Foundation Trust stated that it was undertaking a thorough investigation and that it would be inappropriate to reach conclusions before those inquiries are complete. As reported by Jim Reed and Matthew Hill of the BBC, Prof Steve Hams, the trust’s chief nursing and improvement officer, stated:
“Every patient and family has the right to expect that their personal information will be treated with care, respect and confidentiality. Any concern that records may have been accessed without a legitimate reason is something we take extremely seriously.”
The trust affirmed that should any staff misconduct be identified, appropriate action will be taken through the relevant processes.
Background of the Particular Development
This development unfolds amid a broader, systemic scrutiny of data privacy and patient record handling across the United Kingdom’s National Health Service. Unauthorized record snooping has emerged as a significant operational and ethical challenge for healthcare trusts. An investigation published earlier in the month by the Health Services Journal revealed that at least 214 NHS staff have lost their jobs and approximately 2,000 have been sanctioned for snooping on sensitive patient data over the past five years.
High-profile incidents involving the medical records of victims from the Nottingham and Southport attacks, as well as a child injured in a Cambridgeshire crocodile enclosure, have intensified regulatory pressure. In July, NHS England head Sir Jim Mackey issued a stark warning that personnel engaging in unauthorized data access could face termination or criminal prosecution, prompting trusts to tighten auditing processes and proactively investigate legacy and current electronic file access.
This development is expected to significantly impact patient advocacy groups, bereaved families, and NHS data governance protocols. For families of vulnerable patients and patient safety campaigners, revelations of unauthorized record access erode trust in institutional confidentiality and heighten the emotional distress associated with historical medical negligence or trauma cases. Consequently, patient advocacy networks will likely intensify pressure on the government and healthcare trusts to mandate stricter, cryptographically secured audit trails and multi-factor authentication controls for cloud-stored health records.
For NHS staff and healthcare institutions, this case and the broader crackdown will enforce stricter compliance training, faster disciplinary measures, and a zero-tolerance operational climate regarding data privacy. Employees will face heightened internal monitoring, which may reduce inappropriate file viewing but could also require delicate balancing to ensure emergency medical workflows are not hindered by bureaucratic friction.
