A hospital worker at the private clinic where the Princess of Wales had abdominal surgery is set to face a criminal prosecution following an investigation into claims that the Princess' medical records had allegedly been accessed by staff in 2024, it is understood.
Background of the Incident
The Princess of Wales underwent abdominal surgery at The London Clinic in January 2024. Three trusted employees who worked at the clinic when she was admitted on January 16, 2024, have been dismissed following an internal investigation. The trio were suspected of attempting to access the Princess’ confidential medical records after her 13-day stay, as disturbing rumours concerning her diagnosis and treatment were spread on social media.
The Mirror broke the world exclusive on March 19, 2024, which sent shockwaves through the hospital and Kensington Palace and posed serious questions over the safety of the royal family’s personal data.
King Charles Also a Patient
The King was a patient at the clinic at the same time as the Princess, for treatment on his enlarged prostate. Following his three-night stay, doctors found he had a "form of cancer", for which he is still receiving treatment. The hospital was forced to contact Buckingham Palace after discovering the alleged breach to assure royal aides that the King’s private medical records had not been compromised.
Investigation by ICO
The UK’s privacy watchdog, the Information Commissioner’s Office (ICO), which has the power to launch criminal prosecutions, was notified of the serious alleged breach within 72 hours of the incident occurring. It has presided over an investigation lasting more than two years. A source said: “This has been a complex and delicate matter involving a senior member of the royal family and one of the world’s most trusted hospitals. There has been great anxiousness on all sides and it has been wholly appropriate that the correct procedures during the investigation have been followed.”
The maximum penalty for anyone found to have accessed medical records without cause or consent is an unlimited fine. They do not face prison, but if found guilty are left with a criminal conviction and a criminal record.
Princess's Response
The Princess of Wales, who three days after the Mirror revealed the alleged breach delivered an emotional personal statement on video that she had been diagnosed with cancer, also has the right to launch a civil claim. It is understood that the Princess has no plans to do so.
Sources at the time told The Mirror how medical staff were “left utterly shocked and distraught over the allegations” involving trusted colleagues at the hospital in Marylebone, Central London, which has enjoyed a reputation for discreetly treating the Royal Family, former presidents, prime ministers and celebrities.
Hospital's Reputation and Previous Issues
The late Queen Elizabeth II and Prince Philip were treated there, as were former PMs including Clement Attlee and Anthony Eden. Queen Camilla is the current patron of the hospital. The Princess was secretly admitted to the hospital on January 16, 2024. The following day, Kensington Palace announced that the Princess had undergone planned abdominal surgery the previous day.
Around three weeks later, it is claimed hospital staff allegedly attempted to access the Princess’ medical records. Kensington Palace was notified immediately, with hospital chiefs assuring the household that there would be a full investigation. The Prince and Princess of Wales were also made aware of the allegations and have been kept informed throughout.
Al Russell, the CEO of the hospital, said: “Everyone at the London Clinic is acutely aware of our individual, professional, ethical and legal duties with regards to patient confidentiality. We have systems in place to monitor management of patient information and, in the case of any breach, all appropriate investigatory, regulatory and disciplinary steps will be taken. There is no place at our hospital for those who intentionally breach the trust of any of our patients or colleagues.”
Scotland Yard was notified of the ICO's probe but did not pursue a separate investigation. It is a criminal offence “to knowingly or recklessly obtain personal data without the consent of the data controller”. The ICO has the power to levy huge fines that could run into tens of thousands of pounds.
The health regulator, such as the Nursing and Midwifery Council (NMC), can also take enforcement action such as striking an individual off the register if the breach is serious enough. The hospital was previously criticised for allowing medical records to be “easily available” to doctors and nurses, a Care Quality Commission report revealed. CQC inspectors carried out an unannounced inspection in June 2021 after receiving information that gave concerns about safety and quality. The report concluded that patient records were “stored securely” at the clinic.
Kensington Palace did not comment. The London Clinic and the ICO has been reached for comment.
