that is a breach of patient confidentialty and should be reported. your hospitals should have something called PALs which is the patient advice and liason service, you could contact them and see what advice they offer.
This is good advice and a good route to take.
Natalie,
I was fairly senior in the IT dept of what was then the second largest trust in England and believe me, Medical records and patient confidentiality is something that the NHS has tried to get really serious about in the last ten years. However, I am sad to say it's not always working.
I've never understood a individual persons wish to inform themselves about anothers medical records but sadly, it does happen
I could tell you some shocking stories with regards to how paper medical records are moved around and between hospitals so nothing surprises me

You may have heard that the country has a massive National project to only have electronic patient records which should help, but unfortunately due to staff turnover and the pressures on staff, passwords are frequently shared
The conclusion is, sadly, medical records are not taken seriously enough - I can't tell you how many times I've been in public lifts with Doctors and Consultants openly discussing patients - and yes, I pulled them on it and mentioned "best practice" to them and they were always suitably embarrassed. Unfortunately, it runs through all levels of the NHS.

Good luck with whatever you decide to do.