Viewing patient records without clinical justification sees nurse’s registration suspended

Health practitioners should only access patient records where there is a genuine clinical need, or with specific authorisation. Accessing records out of personal interest, curiosity or for self-education is likely to breach legal, employment and professional obligations, as a case involving a junior nurse illustrates. 

Unauthorised access to records 

Nurse S admitted to accessing patient records without clinical justification or authorisation on 232 occasions. 

The records viewed included those of: 

• the nurse’s partner 
• staff and board members of the clinic  
• patients who had declined to discuss their presenting complaint with the nurse during screening 
• sensitive entries including details about patients’ mental health issues. 

The nurse accepted their conduct breached patient privacy and confidentiality. They also accepted the conduct was contrary to the obligations contained in their contract of employment and workplace privacy and confidentiality agreement. 

The tribunal concluded this was a significant departure from expected professional standards and constituted professional misconduct. 

However, the tribunal accepted that another staff member had shown the nurse how to access the records. This was the nurse’s first role since graduating and the tribunal was prepared to take the nurse’s inexperience into consideration.  

Following the incident, the nurse had cooperated fully and undertaken self-education on health information privacy and data breach requirements. 

The nurse was reprimanded. Their registration was suspended for four months. The tribunal imposed conditions including supervision and further education and reflection on ethics and patient confidentiality. 

The nurse was ordered to pay $1,800 towards the Nursing and Midwifery Board’s costs. 

All health practitioners are under the same obligations regarding accessing patient records, in that legally patient health records can only be used: 

• to provide medical treatment to the patient at the time 
• for limited non-clinical purposes such as billing or complaint management 
• if the patient has consented to access for another purpose (for example, research or to support a compensation or insurance claim), or 
• with legal authority (for example under a subpoena or police warrant). 

Be sure that you understand your legal, professional and workplace obligations to maintain patient confidentiality and protect patient privacy. 

Never be tempted to access patient records for another reason, including personal interest, concern for a family member, curiosity or self-education.  

Consequences of an unauthorised and unjustified access can include fines, employment termination and loss of registration. 

Avant factsheet – Privacy essentials

Avant article – Harsh penalties for unauthorised access to medical records 

Avant factsheet – Preventing data breaches 

Avant eLearning – Medical records: Chapter two – legal requirements 

Office of the Australian Information Commissioner – Handling information in a My Health Record 

Office of the Australian Information Commissioner – Guide to health privacy  

For medico-legal advice, please contact us here, or call 1800 128 268, 24/7 in emergencies.