Trainee doctor investigated for unauthorized access to 47 DH patient records

A specialist trainee doctor assigned by the Hospital Authority (HA) to the Department of Health (DH) is under investigation for allegedly accessing the medical records of 47 patients not under his care while working on a clinical research project.

The DH initiated an investigation after receiving a complaint from a member of the public regarding unauthorized access to their eHealth record.

The probe revealed that in March of this year, a doctor undergoing specialist training at the DH had improperly accessed the medical records of 47 patients.

The access was made through the clinical management system and eHealth platform of the department's social hygiene clinic.

In response to the discovery, the DH has immediately suspended the doctor's training at the facility and has referred the case to the police for further investigation.

The department has also notified all relevant parties, including the Privacy Commissioner for Personal Data, the Commissioner for the Electronic Health Record, and the Hospital Authority, which is the doctor's primary employer. The 47 affected individuals have also been informed of the breach.

The doctor in question had been assigned to the social hygiene clinic since 2023, where he received regular weekly training, participated in clinical work, and provided consultation services to patients.

It is understood that the unauthorized access occurred while the doctor was conducting a clinical research project that had been approved by the Hospital Authority. However, the scope of that approval was limited to patient records within public hospitals and did not extend to patient records held by the DH.

The doctor allegedly accessed the DH records without seeking the necessary independent authorization from the department.

The HA believes that although this was an isolated incident related to clinical research, the procedure was inappropriate.

The HA has committed to following up on the matter seriously and will strengthen training for its staff on the necessary precautions to take when using patient data for clinical research purposes.