A former healthcare worker has been cautioned by the UK Information Commissioner’s Office (ICO) after attempting to access and sell the medical records of Catherine Elizabeth Middleton, Princess of Wales, while she was receiving treatment at the London Clinic.

The ICO launched a criminal investigation in March 2024 following reports that a staff member at the private hospital tried to obtain the princess’s confidential medical information during her stay for abdominal surgery earlier that year.

According to the data protection watchdog, its investigation found evidence of the deliberate misuse of highly sensitive personal information and an attempt to disclose it for financial gain.

The ICO said a formal caution was considered the most appropriate and proportionate enforcement action. However, it noted that the investigation uncovered no evidence of wider organisational failures at the hospital.

ICO Executive Director for Regulatory Supervision, Ian Hulme, said patients must be able to trust that their personal information is protected in healthcare settings.

“People should be able to trust that the personal information they’re giving to healthcare settings is safe and protected from exploitation. When this trust is broken, it’s right that the law allows us to take action,” Hulme said.

Responding to the outcome, a spokesperson for the London Clinic said the hospital was pleased the matter had been resolved, describing the incident as isolated and confirming that no regulatory breaches were found on the part of the institution.

The London Clinic, one of the UK’s largest private hospitals and a facility frequently used by members of the Royal Family, treated Catherine following abdominal surgery in January 2024.

Two months after the procedure, the Princess of Wales revealed she was undergoing cancer treatment. She announced at the beginning of 2025 that she was in remission and has since gradually resumed public duties, including attending this week’s Order of the Garter service.