GP Pharmacist Suspended for Unlawful Access to Patient Records Over Extended Period

Date of Decision: January 23, 2020

Registrant's Role: Pharmacist

Allegations:

• Accessed medical records of multiple patients without clinical justification over several occasions.
• Accessed records of personal acquaintances including colleagues and their family members.
• Knew there was no clinical reason to access these records.
• Breached data protection and confidentiality standards in a healthcare setting.

Outcome: Suspension from the register for 3 months

GPhC Standards Breached:

• Standard 3 – Show respect for others (2012 standards)
• Standard 6 – Behave in a professional manner and act appropriately at all times
• Standard 7 – Respect and maintain a person's confidentiality and privacy
• Standard 9 – Demonstrate leadership

Case Summary

Allegations

This case involves a registered pharmacist who was employed as a pharmacy prescribing advisor at a GP surgery and unlawfully accessed the medical records of multiple patients over a sustained period. The patients whose records were accessed included a colleague (Patient A), a former colleague (Patient B), and their respective family members, totaling eight individuals. The access occurred on multiple dates and was done without any clinical justification. Some accesses were performed remotely while the registrant worked at other GP surgeries.

The pharmacist admitted accessing these records out of concern and curiosity, noting that some patients were behaving erratically or had confided in her. Despite having undertaken prior Information Governance training, she acknowledged her conduct as a serious lapse in judgment and professionalism.

Findings

The panel found all allegations proven based on the registrant’s own admissions. The evidence included statements from her line manager, GPs, and safeguarding professionals. These confirmed that the registrant had no clinical responsibility for the patients in question and that her conduct violated information governance protocols.

During disciplinary investigations, the registrant admitted that her actions were not clinically justified and were driven by personal concern and curiosity. She confessed that she had looked at records to understand the personal or health circumstances of her colleagues and their families. This included accessing lab results, appointment notes, and other sensitive data. The registrant’s own testimony confirmed that on several occasions she acted out of “nosiness” rather than necessity.

GPhC Determination on Impairment

The Committee considered whether the misconduct amounted to impairment of fitness to practise. It determined that while there was no evidence the registrant posed an actual or potential risk to patients, the breach of trust and confidentiality standards was profound. The Committee highlighted that pharmacists, like all healthcare professionals, hold privileged access to patient data and must uphold the highest standards of confidentiality.

The registrant’s actions engaged several criteria under Rule 5(2) of the GPhC’s Fitness to Practise rules:

• Her actions brought the profession into disrepute.
• She breached a fundamental principle of pharmacy: respect for patient confidentiality and privacy.
• However, the panel did not find that her integrity was beyond repair, noting her continued successful practice post-incident and credible testimonials.

“Accessing staff members’ records is a serious matter, even if the Registrant never intended to divulge to anyone the information she obtained. Her conduct fell far below the standard expected of a Pharmacist.”

The registrant was found to have demonstrated genuine remorse and insight. She had reflected deeply on her actions, undertaken relevant CPD training (notably around Standard 7 on confidentiality), and sought counselling. Moreover, her current employers were aware of the incident, had investigated her data handling, and found no issues. Testimonials consistently praised her professionalism and work ethic since the incident.

Sanction

Taking into account the seriousness of the misconduct, the need to uphold professional standards, and the registrant’s high level of remediation, the Committee imposed a three-month suspension from the register. A more lenient sanction such as a warning was deemed inadequate given the repeated nature of the misconduct. Conversely, removal from the register was considered disproportionate due to the registrant’s evident insight, low risk of repetition, and sustained ethical practice in subsequent roles.

The panel was clear that this sanction was necessary not to punish but to:

• Maintain public confidence in the pharmacy profession,
• Uphold the principles of confidentiality and trust,
• Send a clear message about the unacceptable nature of such data breaches.

No review of the suspension was deemed necessary. The registrant was permitted to continue working for 28 days to ease transition during the Covid-19 crisis, after which the suspension would commence.

Key Learning Points for Pharmacy Professionals

1. Unlawful Access is a Serious Breach: Regardless of intent, accessing patient records without clinical justification constitutes a severe breach of trust and confidentiality.
2. Insight and Remediation Matter: Demonstrating understanding, remorse, and taking tangible steps such as CPD, counselling, and reflective learning can significantly influence regulatory outcomes.
3. Transparency with Employers is Crucial: The registrant’s open communication with her current employer, coupled with the employer’s supportive stance, played a pivotal role in mitigating the sanction.
4. Policy Awareness is Essential: Pharmacists must be fully aware of their obligations under information governance policies, especially when working with personal acquaintances in a clinical setting.
5. Maintaining Public Trust: This case underscores that public confidence in healthcare professionals hinges on strict adherence to confidentiality. The pharmacist’s actions, though not harmful in outcome, were still deemed seriously reprehensible.

This determination serves as a critical reminder for pharmacy professionals to rigorously uphold the ethical and legal standards related to patient privacy, even when personal relationships or emotional concerns may tempt deviation.

Original Case Document

The full determination transcript is available to logged in users.

Log in or Register for free to access.