“It was just a peek”: improper access of medical records

Jun 22, 2016

Dr Holiday* is a consultant in a public hospital and is currently going through a nasty divorce. His young daughter recently told him that her mother had been crying all the time and had stayed at the hospital where he worked. Concerned with the welfare of his children, Dr Holiday surreptitiously accessed his ex-wife’s medical record to understand her medical condition and treatment. He discovered that she had been admitted for treatment of a mental health condition.

A couple of days later, Dr Holiday received a letter from his employer asking him to explain why he had accessed his ex-wife’s medical records. The letter warned that his employment might be terminated if he was found to have engaged in misconduct and that the matter may be referred to the Medical Board of Australia.

Rise in improper access of medical record cases

Although it may be tempting for doctors to access a patient’s medical record without consent or authority for whatever reason – it is never appropriate. The increasing use of audits and electronic records has also made it easier for practices and hospitals to discover unauthorised access.

We have recently assisted a number of members in employment and disciplinary matters where it was alleged they improperly accessed patient medical records. These matters reinforce the risks that you face when you access medical records (including your own records and those of your family) if the access is not required for the medical treatment of the patient or consent/authority is not obtained prior to access.

Dos and don’ts

Most hospitals have detailed policies in place about accessing medical records which typically say that you cannot access confidential patient information without consent or authority and when it is not a requirement of your role. Medical records can generally only be accessed for the purpose of providing treatment to a patient. You cannot generally access the record of a patient you have treated for a reason unrelated to that treatment. For example, to check the patient’s termination of pregnancy records if they were referred for peripheral nerve conduction studies. In some circumstances, you may have authority to access medical records for research or teaching purposes. However, you may face disciplinary action if you access a medical record, even your own, if that access is not authorised by the employer’s policy.

In Dr Holiday’s case, he accessed his ex-wife’s medical record for a purpose other than providing clinical care to her and without her written consent. He could also use the information for ulterior purposes such as in divorce and custody proceedings.

A cautionary tale

The Medical Board investigated Dr Holiday’s conduct, including the reasons why he accessed his ex-wife’s medical records. He was ultimately cautioned and ordered to undergo education on decision-making in patient confidentiality.

In some extenuating cases, the Medical Board has suspended the doctor’s registration for up to six months.

Accessing medical records without consent and authority can also result in:

  • a patient complaint to the hospital, Medical Board or Privacy Commissioner
  • issues about the admissibility of the information in legal proceedings, such as Family Court proceedings
  • police prosecution, for example if a Domestic Violence Order was breached.

Key lessons

The Medical Board’s Good Medical Practice: A Code of Conduct for Doctors in Australia emphasises the importance of protecting patients’ privacy and right to confidentiality. Patients have a right to expect that doctors and their staff will hold information about them in confidence unless release is required by law or in the public’s interest. (Read Chapter 1 of our handbook on responding to requests for medical records).

Avoid the risks outlined in the scenario above by treating patients’ information as confidential and only accessing medical records:

  • in accordance with your employer’s policies; and
  • for the purpose of providing medical treatment to the patient at the time. You cannot access the record of a patient you have treated for a reason unrelated to that treatment.

Also ensure that you do not access your own medical record or any family member’s records unless you do so in accordance with your employer’s policy.

Need advice?

If you are in doubt about access of any health information, you should seek advice from Avant’s Medico-legal Advisory Service on 1800 128 268.

* This scenario is a compilation of several cases with details changed to ensure privacy.

Share your view

We welcome your feedback on this article – email the Editor at: editor@avant.org.au