You see a member of staff in the clinic accessing confidential patient data as she is friends with the patient.

Scenario questions like this aren’t really testing what you’d technically “do” — they’re testing whether you can respond to a difficult professional situation calmly, appropriately, and in line with proper procedure, rather than reacting emotionally or avoiding the issue altogether.

Why this situation is serious

Accessing a patient’s records without a clinical reason — even out of curiosity or personal connection — is a breach of one of the core standards clinicians are expected to uphold. It’s not a minor lapse in judgement:

• It directly undermines patient trust, both in that individual and in the wider practice.
• It puts the staff member’s own professional standing at risk, since incidents like this can trigger a formal review of their fitness to practise, and in serious cases, could cost them their job.
• It’s a data breach, which practices are legally and professionally obligated to handle through proper channels.

So while the colleague’s actions are clearly inappropriate, how you respond to witnessing it is just as important as recognising that it’s wrong.

Approaches to avoid

• Publicly confronting the colleague in front of others — this is unprofessional and could embarrass or unfairly single them out before the situation has even been looked into properly.
• Ignoring what you saw — this makes you complicit in a serious breach and fails the patient.
• Discussing it with other colleagues informally, in a way that amounts to gossip rather than proper reporting.

A more appropriate approach

• Speak to the colleague privately and calmly, explaining that what they did isn’t appropriate — this shows maturity and gives them a chance to understand the issue directly from you.
• Escalate the matter by informing a supervisor or practice manager, since this isn’t something that should be resolved informally between colleagues alone.
• Follow the practice’s formal data breach procedure, ensuring the incident is properly documented and handled.

Suggested structure for this question

• Explain clearly why the colleague’s actions are inappropriate — referencing patient confidentiality and professional standards, rather than just saying “it’s wrong.”
• Describe your immediate response — a calm, private conversation with the colleague, followed by reporting the incident to an appropriate senior figure.
• Confirm that you would follow the correct reporting/data breach procedure, showing you understand this isn’t just a personal matter but a formal process.
• Close with reflection — consider why this behaviour is so damaging (trust, patient welfare, professional integrity) and what the wider implications of a confidentiality breach can be, both for the individual and for the profession as a whole. This final step shows the interviewer you can think beyond the immediate scenario to its broader significance.