A healthcare practitioner has been reprimanded for accessing the electronic health records of six patients at a NSW hospital
A registered nurse, who was engaged in a longstanding legal dispute with several patients, improperly accessed multiple district-wide electronic health records of those patients in “a most serious abuse of his professional position”, a tribunal has found.
The practitioner, who was employed on a casual basis at Blacktown Hospital, has been a registered nurse since 2007 and holds postgraduate qualifications in public health and health management.
In the early hours of 14 August 2014, he was found to have accessed a computer that had been logged on by another employee and and then left unattended by that employee.
The nurse accessed six patient records as well as his own in the space of 23 minutes, viewing multiple pages of each patient’s record in that time.
At the time of the incident, he was embroiled in a legal and administrative dispute with five of these patients and was at a critical juncture in “acrimonious” proceedings with Patient A.
None of the patients were under the practitioner’s care at the time of the incident, and the nurse did not have computer system credentials that would have allowed him to access those patient records with his own log on.
Patient A became suspicious that the nurse was using his professional position to access the relevant health records, based upon some information contained in court and administrative documents that he had filed in late 2014.
In early 2015, the nurse was interviewed by a hospital review panel after some of the patients made a joint request for a privacy internal review from the Western Sydney Local Health District.
During the interview, the nurse stated that he knew much of the health information by virtue of his previous personal interactions with the patients.
However the internal review concluded he had breached health privacy principles.
The review recommended the nurse no longer be rostered onto shifts where he could use the electronic record system, and that he undertake online privacy training.
Dissatisfied with this outcome, five of the six patients wrote to the Health Care Complaints Commission (HCCC) seeking further redress.
Altogether the HCCC brought seven complaints of unsatisfactory professional conduct, and one complaint of professional misconduct, before the NSW Civil and Administrative Tribunal.
In oral evidence, the health practitioner acknowledged that his access of the health records was improper and in breach of the relevant policies and codes.
He conceded this was unsatisfactory professional conduct, and expressed “deep remorse and a sense of shame” at what had occurred.
He also ultimately conceded that he had used another staff member’s logon to access the records.
The practitioner claimed he had prior knowledge concerning a specific patient (Patient B) which he had communicated to his lawyer.
However under cross examination, the nurse conceded there were details of Patient B that he was only aware of because of his unauthorised access to the patient’s health record.
He was found to have emailed details of this information to his lawyer.
Evidence showed the nurse accessed Patient B’s health record twice during the 14 August 2014 incident, and 25 separate tabs were opened in that record.
The tribunal found all of the complaints and particulars were established.
“The practitioner unprofessionally and improperly accessed multiple health records. He did so with an intent to advance his own interests and to damage those of at least some of the patients whose privacy he breached,” found the tribunal.
“We find that this was a most serious abuse of his professional position.
“We conclude that the proved complaints must be characterised as professional misconduct both by virtue of the deliberate and unethical nature of the conduct.
“The duty of healthcare professionals is to … safeguard health information, and to only access this information in the best interests of patients to serve their health needs, except in the very limited circumstances where there is an overriding consideration such as the health and safety of the public.”
The tribunal reprimanded the nurse for “breach of patient privacy and confidentiality” and imposed a registration suspension period of six months.
It also ordered costs to be paid to the HCCC.