A former healthcare worker at the London Clinic received a formal caution from the UK Information Commissioner's Office (ICO) for deliberately accessing and misusing the private medical records of Catherine, Princess of Wales, during her treatment in January 2024 [1, 2]. The worker also attempted to offer the records for financial gain.

Princess Catherine, aged 44 at the time, underwent planned abdominal surgery at the London Clinic in January 2024 and was later diagnosed with cancer following postoperative tests [1, 2]. The unauthorized access to her medical information was discovered and reported by the clinic in March 2024, triggering a criminal investigation by the ICO [1, 2].

The ICO concluded that issuing a formal caution under Section 170(5) of the UK Data Protection Act 2018 was appropriate and proportionate after careful assessment under the Code for Crown Prosecutors and ICO prosecution policy [1, 2]. The regulator found no wider organizational failings at the London Clinic that warranted enforcement action.

Ian Hulme, ICO’s Executive Director for Regulatory Supervision, said, "People should be able to trust that the personal information they’re giving to healthcare settings is safe and protected from exploitation. When this trust is broken, it’s right that the law allows us to take action. We will not hesitate to pursue criminal prosecution where it is necessary and proportionate to do so." He added that the breach involved the deliberate misuse of highly sensitive personal data and was a clear violation of trust [1, 2].

A London Clinic spokesperson described the incident as "sad and isolated," adding, "We all take considerable pride in delivering the very highest standards of care and discretion for every patient at the London Clinic. We are pleased our work with the ICO has brought this sad and isolated incident to a conclusion." They also said the ICO called the case isolated following its investigation [1, 2].

The caution is the latest action to address the unlawful access and attempted disclosure of the Princess’s medical records. The ICO’s findings and the clinic’s continued commitment to patient discretion mark the formal closure of the investigation.

No further regulatory enforcement actions against the London Clinic are planned. The former healthcare worker remains subject to the caution as of mid-2026 [1, 2].