Charge
On 26 May 2021, the Health Practitioners Disciplinary Tribunal (the Tribunal) considered a charge laid by a Professional Conduct Committee (PCC) against Dr N, registered medical practitioner (the Practitioner).
The charge alleged that the Practitioner had acted in breach of her ethical obligations and/or accepted standards of practice in the following manner:
1. Between 1 January 2017 and 13 November 2017, while employed as a medical practitioner, she inappropriately accessed and/or viewed electronic clinical records without lawful excuse, justification or authority to do so:
- The Practitioner accessed the electronic clinical records of 21 people in circumstances where she was not involved in their care;
- The Practitioner accessed the electronic clinical records of 13 people for personal reasons and in circumstances where she was not involved in their care;
- The Practitioner accessed a patients’ electronic clinical records, in circumstances where she received his consent but was not involved in his care;
2. Between 24 March 2017 and 10 November 2017, the Practitioner disclosed health information of a patient (she was not involved in their care) to a former friend, without lawful excuse, justification, or authority to do so, and in breach of their privacy.
The conduct alleged above amounted to professional misconduct in that, either separately or cumulatively, it amounted to malpractice or negligence in relation to the Practitioner’s scope of practice pursuant to section 100(1)(a) of the Health Practitioners Competence Assurance Act (the Act); and/or has brought or is likely to bring discredit to the profession, pursuant to section 100(1)(b) of the Act.
Background
An audit identified that the Practitioner had accessed records of 35 patients between 1 January 2017 and 13 November 2017, when there was no clinical reason for her to have access to the records. This included 97 individual documents or screens for the patients.
The Practitioner accessed the electronic clinical records of 21 people when she was not involved in their care. The information accessed and reviewed included referral screens, progress notes and reports, free text letters, psychiatric assessments and discharge/transfer summaries.
There was a group of patients whom the Practitioner knew. The audit established that she accessed and reviewed mental health records for 13 patients for personal reasons.
On 6 separate occasions on, the Practitioner accessed records for a patient whom she knew but had not been involved in their care. The patient had authorised the Practitioner to review his records to see when he had last been offered anti-depressants.
The Practitioner also provided a former friend with photos of two mental health risk assessments concerning a patient. This included details such as his date of birth, NHI number, current risk of suicide and violence, previous diagnoses and proposed management plan.
When users attempt to access records relating to a patient outside of their user group, they are shown a warning message called a “break glass”. This message warns the user that they are not authorised to access specific records and prompts them to identify a reason for access. The Practitioner had circumvented the break glass warning in every instance by typing a punctuation mark or a letter rather than providing a legitimate reason for access.
At the time of these events, the Practitioner was suffering from acute anxiety, undergoing a relationship break-up with her fiancé who had recently displayed a drinking problem.
Accessing patient notes became an anxiety-driven compulsion. It gave the Practitioner a sense of control and turned the unknown into something more manageable. It became a ritual when she was fearful, and she was uncertain if people were who they claimed to be.
Finding
The hearing proceeded on an agreed summary of facts. The practitioner did not dispute the charge or that the conduct amounted to professional misconduct. She admitted that the established conduct was contrary to accepted standards of medical practice.
The Tribunal was satisfied that the conduct was a gross breach of the Practitioner’s ethical obligations. The Practitioner’s actions undermined patient confidence in the confidentiality of the doctor/patient relationship. Members of the public who use health services expect their information to be kept confidential and only accessed by people who have a proper professional reason to do so. The Tribunal stated that the conduct was the digital equivalent of going into a colleague’s office and browsing through physical files.
The Tribunal found that that each particular of the charge amounted to malpractice. That included particular 1(c). Even though the patient had consented to the Practitioner looking at his records, it was not her place to do that.
Aside from particular 1(c) the Tribunal was satisfied that reasonable members of the public could conclude that the reputation and good standing of the medical profession is was lowered by the Practitioner’s behaviour.
Penalty
The Practitioner was:
- Censured;
- Subject to conditions placed on her practice;
- Ordered to pay costs of $30,000.00
The Tribunal ordered suppression of the name and identifying details of the practitioner. The suppression also supressed the names and initials of any patients referred to in the decision.
The Tribunal directed publication of the decision and a summary.