NIR can only be used for direct patient care and does not replace an organisation’s responsibility for controlling and monitoring staff access to patient information.
Healthcare organisations should ensure appropriate role-based access controls are applied within their local systems and that access is monitored and investigated in accordance with their local information governance arrangements.
NIR activity is auditable through PARS, which records NIR query and retrieval activity and can support authorised teams in investigating access queries.
NHS England’s Stopping unlawful access to records - NHS England Digital guidance provides further guidance for healthcare professionals and IG teams on appropriate access, monitoring and responding to potential unlawful access.