Pharmacist Suspension Expires after Illegally Accessing Colleague’s Medical Records and Making Inappropriate Comments

Date of Decision: September 11, 2025

Registrant's Role: Pharmacist

Allegations:

On 17 February 2022, the registrant accessed a colleague's medical records via Evolve without consent or clinical justification.
The registrant used sensitive information obtained from those records to make inappropriate and offensive comments to the colleague, causing distress.

Outcome: Suspension Order (3 months) – Fitness to Practise Found No Longer Impaired; Suspension to Expire Without Further Action

GPhC Standards Breached:

Standard 6 – Communicate effectively: The registrant failed to maintain appropriate boundaries and used private medical information inappropriately.
Standard 7 – Respect and maintain a person's confidentiality and privacy: The registrant accessed medical records without consent or justification, breaching confidentiality.
Standard 9 – Demonstrate leadership: The registrant failed to act as a role model by breaching trust and failing to disclose his misconduct transparently.

Case Summary

Allegations

The case involved a serious breach of data privacy and professional conduct by a pharmacist who accessed a junior colleague’s medical records without consent or clinical justification while working at Buckinghamshire Healthcare NHS Trust. The registrant then used this confidential information to make inappropriate and distressing comments to the colleague (referred to as Person A), triggering significant emotional harm. The allegations, which were admitted by the registrant, led to a finding of misconduct and initial suspension.

On 17 February 2022, the pharmacist accessed Person A’s digital medical file via the “Evolve” system for 17 minutes. The records viewed included GP letters and other sensitive documents. Subsequently, the pharmacist confronted Person A with personal questions clearly informed by these records, referring to medical conditions and asking where certain items could be purchased—none of which were relevant to their clinical duties at the time. This misuse of privileged access was compounded by inappropriate commentary and a lack of transparency when initially questioned about the incident.

Findings

The Principal Hearing Committee determined that the pharmacist had breached several professional standards, particularly around confidentiality, integrity, and leadership. Although dishonesty was not formally alleged, the committee expressed grave concern over the registrant’s shifting explanations and lack of initial candour.

At the original hearing in May 2025, the committee found:

The pharmacist accessed records deliberately and without justification.
The pharmacist used the information to engage Person A in distressing conversation.
There was a pattern of evasiveness and minimisation in the registrant’s early explanations.
There was insufficient evidence at the time to conclude that the registrant had developed adequate insight or implemented meaningful remediation.

As a result, the registrant’s fitness to practise was found impaired under rules relating to patient safety, public confidence, and integrity of the profession, leading to a 3-month suspension with a requirement for review.

GPhC Determination on Impairment

By the time of the review hearing in September 2025, the registrant had undertaken substantial reflection and remediation. This included:

Completing CPD training on GDPR, confidentiality, and professional judgement.
Participating in peer discussions and mentoring sessions at his current employer, Milton Keynes University Hospital.
Providing detailed reflective statements and character references from senior colleagues.
Attempting to secure audit trails of medical record access (though not yet available at the time of the review).

The Committee concluded that the registrant had gained significant insight into the misconduct and its broader implications.

“I now recognise that this was an instinctive act of self-preservation, prioritising my reputation above honesty and professional duty. This lack of candour caused further damage… I now understand integrity is not situational; it is a constant quality. If I uphold it, others are encouraged to do the same.”

The Committee acknowledged the registrant’s sincere remorse, commitment to change, and personal growth. It found the registrant no longer posed a risk to patients or public trust and that the initial suspension had adequately addressed the public interest component of the case.

Sanction

With the registrant deemed not currently impaired, the Committee took no further action. The existing 3-month Suspension Order will expire on 24 September 2025, after which the registrant may return to unrestricted practice. The Committee highlighted the registrant’s improved understanding of confidentiality, boundaries, and leadership responsibilities as evidence that the risk of repetition was low.

Key Learning Points for Pharmacy Professionals

Access to Medical Records Must Be Justified: Accessing patient records without consent or clinical need is a severe breach of confidentiality and trust, regardless of personal or workplace relationships.
Integrity Extends Beyond the Pharmacy Counter: Pharmacists are expected to uphold professional standards in all aspects of their work, including transparency when under scrutiny. Delayed or partial truth-telling can aggravate an already serious situation.
Remediation Requires Action, Not Just Words: The registrant’s path to redemption included concrete steps such as training, mentorship, and honest reflection. These are essential for demonstrating insight and rehabilitation.
Confidentiality Is Foundational: Even one breach can have lasting emotional impact on patients or colleagues and damage public trust in the profession.
Leadership by Example Matters: Senior professionals must model ethical behaviour. Misconduct by leaders can erode standards across a team and have a wider cultural impact.
GDPR Is Not Optional: Pharmacists must understand and apply data protection laws rigorously. The registrant’s failure to do so highlighted a critical training need that was later addressed.

This case underscores the importance of vigilance, professionalism, and accountability in handling sensitive information—especially in the context of hierarchical professional relationships. The registrant’s initial failure was serious, but the case also offers a template for how insight and proactive remediation can restore professional standing.

Original Case Document

The full determination transcript is available to logged in users.