An official complaint is the right thing to do and I suspect given that all our records are on this super database now, there should be a record of who accessed them and when and hopfully WHY. This guy has broken the data protection laws for starters, not to mention your nhs trusts own policys.