NHS Tayside apologises after Ninewells patient records were accessed nearly 400 times
NHS Tayside has begun contacting almost 400 patients after a Ninewells Hospital scientist viewed their records inappropriately and was later dismissed for gross misconduct. The case centers on patient confidentiality, professional boundaries, and the safeguards needed when clinical information systems are used outside direct care.
Dr Glen Gardner accessed patient records 497 times while assigned to non-clinical duties, including some records on multiple occasions. The health board has apologised directly to affected patients and said the incident was reported to the Information Commissioner’s Office. The regulator found no evidence that personal data left NHS Tayside’s systems.
A breach like this matters because electronic records are not passive files. They contain intimate details that can affect trust, decision-making, and willingness to seek care, especially when access occurs outside a legitimate treatment relationship. Even when information never leaves the system, improper viewing can still damage confidence in how health services handle private data.
How the breach came to light inside the hospital system
Gardner had worked as a clinical scientist for more than 15 years before being moved to non-clinical duties in 2023 after allegations involving advice he gave to a patient about breastfeeding while she was undergoing treatment. In May 2024, a colleague noticed that he was using the patient records system known as CRIS and was viewing a record despite having previously been told he was assigned elsewhere.
That prompt observation triggered a review. Investigators found that nearly 400 patient records had been accessed, with some opened more than once. The detail is important: this was not a one-off click in error, but repeated activity across a substantial number of records, which is why the trust response escalated to a formal disciplinary process.
During an investigatory meeting, Gardner admitted accessing the records but disputed that his role had changed. He said no written instruction had told him not to use CRIS and argued that he had been carrying out an audit of breastfeeding patients. He also said he had not yet recorded that audit and planned to do so when his clinical systems were restored.
Those explanations did not persuade the tribunal. Employment Judge Paul Rae concluded that NHS Tayside had acted reasonably in treating the conduct as a sufficient reason for dismissal. The tribunal accepted that Gardner did not provide a satisfactory explanation for why he had accessed the records or evidence that the data were used for a legitimate purpose.
One fact drives the whole case: repeated access without a clear clinical need is enough to breach trust, even when the data never leave the hospital network.
Why confidentiality failures carry weight even without data export
The Information Commissioner’s Office concluded that there was no evidence the personal data left NHS Tayside’s systems. That finding narrows the regulatory consequences, but it does not erase the breach itself. In healthcare, unauthorized access can still be harmful because privacy is a core part of the clinical contract. Patients disclose sensitive information because they believe it will be seen only by staff involved in their care.
The case also shows how records systems can be misused when roles are blurred. A scientist moved away from clinical work may still have technical familiarity with patient databases, and that familiarity can become a risk if access controls and supervision are not clearly aligned with changed duties. Hospitals depend on electronic audit trails to detect those mismatches, and this case was uncovered only because a colleague noticed the access pattern.
NHS Tayside said the affected patients are being contacted directly and offered a sincere apology. The board also said a comprehensive investigation under NHS Scotland workforce policy identified that personal information was viewed inappropriately by a single staff member and that the employee was dismissed in June 2025. The board added that the tribunal backed the dismissal.
Regulatory response focused on lack of wider harm
The ICO confirmed it had received the report and reviewed both the circumstances and the action taken by NHS Tayside. It decided not to pursue criminal prosecution or further regulatory action, citing the dismissal and the absence of evidence of harm to patients. In practical terms, that leaves the incident as a serious internal governance failure rather than an event with demonstrated downstream leakage of data.
Still, the episode sits at the intersection of employment law, information governance, and patient safety culture. Healthcare organizations often rely on staff judgment to protect confidentiality, but judgment alone is not enough when access rights remain technically available after job changes. The safest systems are those that automatically restrict access when roles change, flag unusual use quickly, and require clear documentation when records are opened for legitimate audit or quality-improvement work.
For patients, the most immediate consequence is uncertainty: who saw their information, why it was viewed, and whether anything was copied, shared, or discussed inappropriately. For staff, the case is a reminder that claiming a legitimate purpose after the fact is not enough without documentation, predefined authorization, and a clear paper trail. Those standards exist because healthcare data are not just administrative entries; they are part of a person’s private medical history.
What the Ninewells case leaves unresolved
The tribunal’s findings settle the employment dispute, but they do not answer every operational question. The record does not describe whether the access controls at CRIS were tightened after the breach, how many departments were affected by the role change, or whether additional monitoring was introduced to detect similar behavior earlier. Those omissions leave the compliance lesson intact but incomplete.
The incident also raises a broader question for hospitals that use large shared record systems: how quickly can access be removed when staff move away from direct care, and how reliably are those changes reflected across all digital platforms? Until those controls are tested in real use, confidentiality will remain vulnerable to exactly the kind of repeated access seen here.