A former worker at London's private Harley Street hospital has been formally cautioned by the UK's data protection regulator after trying to sell Princess Catherine's medical records from her abdominal surgery in January 2024, according to BBC News and The Guardian.

The person accessed Catherine's medical notes while she was a patient at the London Clinic and then offered to sell that information for money. The Sydney Morning Herald described the material as "highly sensitive personal information." No one publicly confirmed they bought the records, and it's unclear whether any sale actually happened.

The Information Commissioner's Office, the UK's official agency that enforces data protection rules, started investigating the London Clinic in March 2024, weeks after Catherine's hospital stay became public, according to Reuters. At that time, newspapers and the public were intensely curious about her medical condition — which would have made her records valuable to tabloid outlets or gossip networks.

A formal caution is not a criminal conviction, but it is recorded on someone's employment history and can make future jobs difficult. The regulator uses cautions when there's clear evidence of a rule-breaking, but decides prosecution isn't the right step or when the person admits what they did. In this case, there were no criminal charges under laws that normally cover illegal access to personal data — laws that can result in jail time for deliberate, commercial misuse.

The London Clinic — a well-known private hospital that has treated royal patients for many years — said it takes patient privacy very seriously when the investigation was announced in March 2024. But the case raises real questions about how private hospitals protect patient information, particularly whether they properly limit which staff members can see which patient records on their computer systems. Major hospitals run by the NHS routinely tighten who can look at famous patients' files; private hospitals don't always follow the same strict rules.

The broader context here matters. The data protection regulator can investigate both the hospital and individual workers who break the rules. The caution given to the former worker doesn't mean the London Clinic is off the hook — the regulator could still decide the hospital itself didn't have strong enough security measures to prevent this kind of breach. As of mid-June 2026, no formal judgment against the hospital has been announced.

For the team protecting Catherine and Prince William, this case shows a vulnerability that guards and fences can't stop: medical records held by outside hospitals and providers are still at risk from insiders willing to sell them. Catherine's 2024 hospital visit already stirred up intense media speculation, and someone trying to profit from her records fits a familiar pattern of invasion that led to a major inquiry into British tabloid practices a decade before.

The caution brings the official investigation to a close, but questions remain about whether the London Clinic itself needs to answer for what happened.