Staff at the London Clinic could face enforcement action, including fines and prosecutions, if they are found to have accessed the Princess of Wales’s medical records, a government minister has said.

The health minister Maria Caulfield told Sky News it was “pretty severe and serious stuff to be accessing notes that you don’t have permission to”.

She also said police had “been asked to look at” whether staff at the clinic attempted to access the princess’s private medical records.

Caulfield was speaking after the private hospital reportedly launched an investigation over claims first reported in the Mirror that at least one member of staff tried to access Catherine’s private medical records while she was being treated there in January.

The Mirror quoted a source who said senior hospital managers had “contacted Kensington Palace immediately after the incident was brought to their attention and assured the palace there would be a full investigation”.

Caulfield said: “The [privacy and data watchdog] information commissioner would take enforcement action against trusts or primary care practices, but also, as individual practitioners, your regulatory body … would take action as well.

She said it would be “very disappointing” if the notes had been accessed, but added that the public should be reassured that “there are very strict rules about which patient notes you can access”, restricting health workers to the patient notes that they are caring for, and with their permission.

She added: “From a health perspective, it’s not acceptable to be looking at people’s notes, but it has been spotted and action has been taken so people can be reassured that if it does happen – particularly with electronic notes these days, it’s spotted pretty quickly if someone’s accessing notes that they shouldn’t be.”

Speaking later to LBC, Caulfield added: “The information commissioner can also take prosecutions, can also issue fines, the NMC [Nursing and Midwifery Council], other health regulators can strike you off the register if the breach is serious enough.

“So there are particularly hefty implications if you are looking at notes for medical records that you should not be looking at.”

Asked if the police should look into the matter, she said: “My understanding is that police have been asked to look at it. Whether they take action is a matter for them.”

A Met police spokesperson said: “We are not aware of any referral to the Metropolitan police at this time.”

A spokesperson for the Information Commissioner’s Office said on Tuesday: “We can confirm that we have received a breach report and are assessing the information provided.”

Kensington Palace said: “This is a matter for the London Clinic.”

In a statement to the Mirror, the London Clinic said: “We firmly believe that all our patients, no matter their status, deserve total privacy and confidentiality regarding their medical information.”

Details of the princess’s condition and surgery have not been disclosed. Kensington Palace previously said it was not cancer-related and that she wished for her personal medical information to remain private.

The investigation comes after a difficult time for the Princess of Wales, following the fallout from her first official photograph released to the media since she underwent surgery.

The image, released on Mother’s Day, was later withdrawn from circulation by photographic agencies after concerns were raised over image manipulation.

The princess later issued a public apology and said she was responsible for digitally editing the photograph.