Aberdeen hospital fraud exposes a break in ward security and file access controls
A man who posed as a medical student at Aberdeen Royal Infirmary and gained access to wards, staff-only areas and medical files has been ordered to complete 300 hours of unpaid work. The case turned on more than a costume. It involved a sustained deception inside a working hospital, where trust, identification checks and privacy safeguards are supposed to operate continuously.
Stephen Simpson, 22, admitted carrying out the fraud between 9 December 2023 and 26 January 2024. He entered the hospital wearing medical scrubs, NHS-branded clothing, a stethoscope and a pager, creating the appearance of a legitimate trainee clinician. In a healthcare setting, those visual cues can carry real weight: a uniform often functions as an informal credential before a badge is even checked. When that assumption is wrong, the result is not simply embarrassment. It can open a route into restricted clinical spaces and sensitive patient information.
The court heard that Simpson falsely told staff he was an authorised medical student and persuaded them to let him remain in the hospital. He gained access to restricted areas, wards and medical files, and also stole NHS-branded clothing, a pager and perfume. NHS Grampian later said it reviewed its security arrangements and took appropriate action after the case came to light.
One detail makes the case especially striking. Security staff were initially confronted not by a formal challenge at the door, but by a call on Christmas Day from a man claiming to be a medical student in the eye clinic who had found a damaged charity coin-collector machine. When the security officer met him, Simpson was wearing green scrubs with a stethoscope around his neck. He gave a false name and said he was studying. He was allowed to continue, and the incident was documented.
A costume was enough to move through clinical space
On 27 December, staff returning after the festive break discovered that lockers had been rummaged through. Perfume had gone missing from one locker and NHS clothing from another. Security was alerted, the Christmas Day incident was revisited, and police were contacted. That sequence shows how quickly a breach can become visible only after the fact, once staff compare notes and link apparently separate events.
CCTV review then expanded the picture. Multiple incidents were identified in which medical notes were handed to staff by Simpson. He was also seen leaving a lift with documents in his hand and taking a selfie on a mobile phone before passing notes to staff. Those details matter because they suggest repeated movement through the hospital in a role he was never meant to occupy. Even without evidence that he altered records or contacted patients directly, the repeated handling of documents in restricted clinical space raises obvious concerns about privacy, chain of custody and the reliability of informal access control.
A consultant surgeon’s pager was among the items involved and was later deactivated. Police inquiries established that Simpson had been studying access to nursing, but that did not include placements or access to NHS equipment. In other words, he had proximity to a professional pathway, but no legitimate reason to cross the line into active hospital operations.
Privacy harm without face-to-face patient contact
At Aberdeen Sheriff Court, Sheriff Morag McLaughlin said the seriousness of the offence reached the custody threshold, but prison would be disproportionate in light of the circumstances and sentencing guidelines. Simpson was instead ordered to carry out 300 hours of unpaid work and placed under supervision for two years. He had previously pleaded guilty to two amended charges after originally facing six charges, including one of fraud and five of theft.
His lawyer, Laura Gracie, said there was no suggestion he had actually done anything with the patient files in question. The hospital later stressed a similar point, saying Simpson had no face-to-face patient contact and never accessed its IT systems. The Information Commissioner’s Office was notified and concluded no further action was required.
Those two facts narrow the immediate data breach risk, but they do not erase the underlying failure. Access to patient files in any form can expose names, diagnoses, clinic attendance, treatment plans and other confidential details, even when digital systems remain untouched. In a hospital, the boundary between “seeing” and “using” information is not a trivial distinction. A person who is not part of the workforce should not be in a position to handle notes, move through staff areas or appear credible enough to be waved past routine checks.
The sheriff described the offence as serious and potentially dangerous, with a violation of privacy involving sensitive information. That language reflects a plain clinical truth: hospitals depend on layered verification, because a single convincing appearance can defeat a weak front-line check. Scrubs, a pager and the right tone can create instant legitimacy in a busy ward corridor, especially during holidays when staffing patterns shift and vigilance can fragment.
Security after the breach now depends on process, not assumption
NHS Grampian said it had reviewed security arrangements and taken appropriate action, acknowledging the concern for patients, staff and the wider public. The case places pressure on institutions to ask a basic operational question: how often does access depend on recognition, familiarity or clothing rather than verification? In a large hospital, staff turnover, student placements, agency workers and shifting ward teams can make visual cues useful, but they are never enough on their own.
This was not a case of direct harm to a patient at the bedside, and no IT intrusion was identified. Even so, the facts point to a preventable vulnerability in the way a hospital environment can be entered and navigated. The practical risk is straightforward: once an impostor is accepted into the flow of clinical work, every additional minute inside the building increases the chance of privacy loss, misplaced documents or further theft.
The case now closes with a community payback order, but the broader issue remains the same for every acute-care site that relies on badge culture and informal recognition. A hospital that cannot quickly distinguish a student from a stranger has already lost control of its threshold.