Former healthcare worker tried to sell Princess of Wales' medical records for cash

EXCLUSIVE: A hospital worker has been struck off and sacked after an investigation into claims the Princess of Wales's medical records were allegedly accessed by a staff member when she was a patient at the London Clinic in 2024

A hospital worker at the private clinic where the Princess of Wales had abdominal surgery has been struck off and sacked from their job following an investigation into claims that the Princess' medical records had allegedly been accessed by staff in 2024, it is understood.

The Information Commissioner's Office has revealed that the hospital worker at the centre of an alleged breach of the Princess of Wales' medical records deliberately accessed the files and had made an offer of disclosing them for financial gain.

The hospital worker had been cautioned by the ICO for that it described as "the deliberate misuse of highly sensitive personal information" and "a clear breach of trust".

The trusted employee, who worked at The London Clinic when the future queen was admitted on January 16, 2024, has been dismissed from their role following an internal investigation, it is understood. The staff member was suspected of attempting to access the Princess’ confidential medical records following her 13-day stay at the hospital, as disturbing rumours concerning her diagnosis and treatment were spread on social media by sick trolls.

The Mirror broke the world exclusive on March 19, 2024, which sent shockwaves through the hospital and Kensington Palace and posed serious questions over the safety of the royal family ’s personal data.

The King was a patient at the clinic at the same time as the Princess, for treatment on his enlarged prostate. Following his three-night stay, doctors found he had a "form of cancer", for which he is still receiving treatment.

The hospital was forced to contact Buckingham Palace after discovering the alleged breach to assure royal aides that the King’s private medical records had not been compromised.

The UK’s privacy watchdog, the Information Commissioner’s Office (ICO), which has the power to launch criminal prosecutions, was notified of the serious alleged breach within 72 hours of the incident occurring, in line with official guidelines. It has presided over an investigation lasting more than two years. It is understood the ICO agreed to the sanction of the individual being removed from their post and struck off.

A source said: “This has been a complex and delicate matter involving a senior member of the royal family and one of the world’s most trusted hospitals. There has been great anxiousness on all sides and it has been wholly appropriate that the correct procedures during the investigation have been followed.”

The maximum penalty for anyone found to have accessed medical records without cause or consent is an unlimited fine. The Princess of Wales, who three days after the Mirror revealed the alleged breach delivered an emotional personal statement on video that she had been diagnosed with cancer, also has the right to launch a civil claim. It is understood that the Princess has no plans to do so.

Sources at the time told The Mirror how medical staff were “left utterly shocked and distraught over the allegations” involving trusted colleagues at the hospital in Marylebone, Central London, which has enjoyed a reputation for discreetly treating the Royal Family, former presidents, prime ministers and celebrities.

The late Queen Elizabeth II and Prince Philip were treated there, as were former PMs including Clement Attlee and Anthony Eden. Queen Camilla is the current patron of the hospital, a role she has held since 2017 when formerly The Duchess of Cornwall. The Princess was secretly admitted to the hospital on January 16, 2024.

The following day, on January 17, shortly after 2pm, Kensington Palace announced that the Princess had undergone planned abdominal surgery the previous day. She was last seen in public during the royal family’s walk to and from church at Sandringham on Christmas Day and had not appeared unwell.

But with the news followed a statement that she would remain at the London Clinic in Marylebone for up to two weeks and most likely be off royal duties until Easter. Charles and Kate were discharged separately just hours apart on January 29.

Around three weeks later, it is claimed a member of hospital staff allegedly attempted to access the Princess’ medical records. Kensington Palace was notified immediately of the alleged incident, with hospital chiefs assuring the household that there would be a full investigation.

The Prince and Princess of Wales were also made aware of the allegations and have been kept informed throughout. At the time, Al Russell, the CEO of the hospital said: “Everyone at the London Clinic is acutely aware of our individual, professional, ethical and legal duties with regards to patient confidentiality.

“We have systems in place to monitor management of patient information and, in the case of any breach, all appropriate investigatory, regulatory and disciplinary steps will be taken. There is no place at our hospital for those who intentionally breach the trust of any of our patients or colleagues."

Scotland Yard was notified of the ICO's probe but did not pursue a separate investigation. The ICO has the power to levy huge fines that could run into tens of thousands of pounds. The individual concerned at the London Clinic has not faced criminal prosecution or received a fine.

The health regulator, such as the Nursing and Midwifery Council (NMC), can also take enforcement action such as striking an individual off the register if the breach is serious enough.

The hospital was previously criticised for allowing medical records to be “easily available” to staff, a Care Quality Commission report revealed. CQC inspectors carried out an unannounced inspection in June 2021 after the CQC “received information that gave us concerns about the safety and quality of services”.

The report added: “Those concerns arose from several never events and serious incidents and numerous whistle-blowers around staffing and culture.” However, the report concluded that patient records were “stored securely” at the clinic.

A statement from the Information Commissioner said: "The Information Commissioner’s Office (ICO) has concluded its criminal investigation into the unlawful obtaining and disclosure of medical information to a third party without the consent of the data controller, related to a breach reported by the London Clinic in March 2024.

Following a full assessment under the Code for Crown Prosecutors and the ICO’s Prosecution Policy, the ICO issued a now former healthcare professional from London with a formal caution in relation to an offence under section 170(5) of the Data Protection Act 2018. The conduct involved the deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain, representing a clear breach of trust.

The ICO considers the available evidence and the public interest in every criminal investigation. In this instance, we concluded that a caution was the appropriate and proportionate enforcement response.

We also considered whether there were any wider organisational issues arising from the healthcare provision in this matter. Based on the evidence available, we did not identify any failings that would meet the threshold for regulatory enforcement. "

Ian Hulme, Executive Director for Regulatory Supervision, said: "People should be able to trust that the personal information they're giving to healthcare settings is safe and protected from exploitation. When this trust is broken, it's right that the law allows us to take action. We will not hesitate to pursue criminal prosecution where it is necessary and proportionate to do so."

A spokesperson at The London Clinic said: "We all take considerable pride in delivering the very highest standards of care and discretion for every patient at The London Clinic. We are pleased our work with the ICO has brought this sad and isolated incident to a conclusion. There were no regulatory breaches by the hospital."

Kensington Palace did not comment.