🟡 Medium | Source: The Register — Security
NHS Tayside is investigating whether staff improperly accessed the medical records of nine-year-old Minnie Merriman following her death and the arrest of a man on suspicion of murder. The probe was triggered after her identity was publicly named this week, raising concerns about curiosity-driven snooping on a high-profile case. This highlights the persistent insider threat risk within healthcare record systems, where access controls and audit logging are critical safeguards.
Security Architect’s Take: Ensure your organisation’s EHR and data platforms enforce role-based access controls tied to active care relationships, and that automated alerts are configured to flag access to records of deceased or high-profile individuals — particularly following media coverage that could prompt curiosity-driven lookups.
Original advisory: Scot NHS trust probes access to medical records of 9-year-old girl after man arrested on suspicion of murder