Curiosity killed the career

Curiosity may be human, but in healthcare it can cost careers — especially when it crosses into patient privacy.

The 16th century idiom ‘curiosity killed the cat’ refers to the perils of someone being too inquisitive or nosy. While professional curiosity is needed to provide health care to patients, a recent case has highlighted the risks of curiosity to health workers when accessing medical records.

The G list

A long-serving staff member at Monash Clayton Hospital told the Daily Mail that she had been dismissed for unauthorised access to a former Victorian Premier’s medical records.¹ ‘I looked it up … I pressed the restricted access button, had a quick skim … and that was it. [I] didn’t read anything, didn’t tell a soul.’

While the staff member said she hadn’t disclosed any information, she claimed her managers acted ‘like I’d committed a crime’. She alleged she’d ‘seen colleagues check family or friends [records]; everyone does it’.

What’s the problem if nothing was disclosed?

Health professionals have access to privileged health information. This privilege not only confers a responsibility of confidentiality, it confers a responsibility to access information only for the purpose it was originally collected for, or other authorised purposes. Breaches can have severe professional and legal consequences.

What are the laws?

Healthcare workers’ access to patient information in Australia is governed by the Privacy Act 1988, which includes the Australian Privacy Principles. More specific requirements are contained in state and territory regulations. For example, in this case, the Health Privacy Principles within Victoria’s Health Records Act 2001 apply.²

There are other state and national regulations that deal with specific aspects of health records access, such as the My Health Records Act 2012 in relation to accessing the My Health Record system. 

The Ahpra Code of Conduct for all registered health professionals also outlines privacy and confidentiality obligations. The main take-out message of all these regulations is similar: you can only access a person’s records for the purpose of providing health care.

What are the exceptions?

Valid reasons for accessing records may also include for clinical audit or other quality assurance activities, or to fulfil legal obligations (e.g. respond to a warrant or patient request for information).

Is this case an outlier?

There are a number of media reports of similar cases, such as a 2024 investigation into 18 SA Health staff who accessed records of the deceased son of the SA Police Commissioner after a motor vehicle accident.³ In Victoria, a pharmacist was dismissed by Alfred Health in 2023 after viewing records of more than 7,000 patients over 4 years without a clinical reason to do so.⁴

While these cases appear motivated by curiosity, other cases on the public record were reportedly motivated by personal advantage, such as accessing information in relation to family members or colleagues.^5privac

References

1. Daily Mail. Dan Andrews hospital records scandal: Monash Health staff sacked over patient data breach. At: https://www.dailymail.co.uk/news/article-15583153/dan-andrews-hospital-records-sacked-monash-health-scandal.html
2. Victorian Government Department of Health. Health records: rights and privacy principles. At: https://www.health.vic.gov.au/rights-and-advocacy/rights-and-privacy-principles
3. ABC News. SA Health finds staff engaged in misconduct over patient records. At: https://www.abc.net.au/news/2024-12-20/sa-health-finds-staff-engaged-in-misconduct-/104753080
4. The Age. Curious pharmacist spied on patient records at the Alfred. At: https://www.theage.com.au/national/victoria/curious-pharmacist-spied-on-patient-records-at-the-alfred-20231025-p5eet1.html
5. Avant Mutual. Harsh penalties for unauthorised access to medical records. At: https://avant.org.au/resources/harsh-penalties-for-unauthorised-access-to-medical-records