The mother of a teenage boy who died in hospital has said she is “deeply concerned and hurt” after learning his medical records may have been accessed inappropriately for years after his death.

Paula McGowan, whose 18-year-old autistic son Oliver died in 2016, was told that at least five members of staff at Bristol Foundation NHS Trust may have accessed his records without permission as recently as this year.

Three nursing staff are under formal investigation, while a doctor who no longer works for the trust has self-referred to the General Medical Council. Another member of staff is having their case reviewed separately.

The trust said it was “deeply sorry” for any stress and anxiety caused.

It said it had voluntarily referred itself to the Information Commissioner’s Office.

It is the latest case involving concerns that NHS staff may have accessed patient records without a legitimate professional reason. In July the head of NHS England, Sir Jim Mackey, issued a “stark warning” that staff could face the sack or even prison for doing so.

Recent high-profile examples include the victims of the Nottingham and Southport attacks and a child who was injured in a crocodile enclosure in Cambridgeshire.

This month an investigation for the Health Services Journal found that at least 214 NHS staff have lost their jobs and around 2,000 been sanctioned for snooping on sensitive patient data over the past five years.

Oliver, who had a mild learning disability and epilepsy, died in 2016 at Southmead Hospital in Bristol after being given anti-psychotic medication that his family had repeatedly warned he should not receive.

After requesting information about his medical records, his mother was told that 38 people had accessed the data since his death, with 637 items viewed and 67 printed off.

Most access was appropriate and linked to complaints, legal proceedings, and the coroner’s inquest into his death.

But three nursing staff not involved in his care are currently under formal investigation after initial inquiries could find no evidence they had a legitimate reason to view her son’s records.

A fourth member of staff is having their case reviewed separately.

McGowan said she was told that one nurse wanted to view the files as they had a general interest in anti-psychotic drugs and the care of patients with a learning disability.

The trust is also looking into 13 another cases involving former staff, including doctors, nurses and clerical workers, to establish if that access was appropriate or not.

One doctor, who no longer works at the trust, has already referred themselves to the medical regulator, the GMC, after being approached by the hospital.

McGowan told the BBC she was “deeply hurt, deeply disappointed” after being told about the investigation, which is ongoing.

“I’ve always been open and honest but there are deeply personal things in Oliver’s [medical] notes that I don’t tell anybody,” she said.

“He died in pain and it’s not pleasant if that side of Oliver’s death has been accessed.”

Her husband, Tom McGowan, said that the risk of unauthorised access to medical records had increased as more information is stored on digital, cloud-based platforms.

“It’s a weakness in the system and action needs to be taken now to tighten up controls,” he said.

Bristol NHS Foundation Trust said it was undertaking a “thorough investigation” and it would be “inappropriate to reach conclusions before those enquiries are complete”.

“Every patient and family has the right to expect that their personal information will be treated with care, respect and confidentiality,” said Prof Steve Hams, the trust’s chief nursing and improvement officer.

“Any concern that records may have been accessed without a legitimate reason is something we take extremely seriously.”

The trust said that, should any staff misconduct be identified, “appropriate action will be taken through the relevant processes”.

NHS medical records can contain highly sensitive personal information, ranging from test results and hospital discharge summaries to details of prescriptions and medications.

That extends well beyond the information available to patients through the NHS app and may include safeguarding concerns, risk assessments, correspondence between healthcare professionals and detailed consultation notes.

There is no single NHS-wide electronic record system that every member of staff can access.

Instead, organisations including GP practices, hospitals and specialist clinics maintain their own records and determine who can view particular information.

Doctors, nurses and other healthcare staff often need fast access, particularly in emergencies.

However, they should only view confidential information when they have a legitimate work-related reason and the right authorisation.

IT systems keep an audit trail that should be able to show exactly who accessed a patient’s records and when.

NHS England said any instance of staff looking at records without a valid reason would be “wholly unacceptable, a disgraceful breach of patients’ trust and against the law”.

“We have been crystal clear that staff could face disciplinary action for any breaches, including the loss of their job and potential criminal prosecution,” added a spokesman.