Hospital worker accessed records in revenge-motivated data breach

A young woman who unlawfully accessed and shared private medical records when she worked at a hospital has been sentenced.

Redland Hospital, where a worker accessed medical data and later disclosed it to a third party. Pictures: Richard Walker

A former Redlands Hospital worker has avoided a conviction after pleading guilty to stalking, unlawfully accessing a hospital database, and disclosing confidential patient information.

The 20-year-old, who cannot be named for legal reasons, appeared in the Cleveland Magistrates Court on Thursday, where she pleaded guilty to unlawful stalking or intimidation, using a restricted computer system without consent, and breaching confidentiality as a designated person under Queensland’s Hospital and Health Boards Act.

The court heard that between December 2023 and October 2024, the worker repeatedly accessed confidential electronic medical records of multiple individuals using her staff credentials, without the required authorisation.

Police prosecutors said the worker accessed the health database on numerous dates, unlawfully viewing records relating to an individual and their close family members, including a child.

The worker then disclosed information to other people and shared details of those records in person and via social media platforms.

The court heard the worker told a third party they intended to report confidential health information to child protection authorities in an attempt to have a baby removed from its home.

The court also heard that no such referral was made by the hospital and no clinical basis for one had existed.

The worker’s actions led to severe personal consequences for the affected individual, including having to undergo unnecessary blood and urine testing for drugs and reputational harm.

Magistrate Deborah Vasta said the worker’s conduct was deliberate and caused significant distress to others.

Magistrate Deborah Vasta said accessing the medical data was revengeful. Picture: The Courier-Mail

“You targeted this (person) … It was revengeful, and it was absolutely stalking behaviour,” Magistrate Vasta said.

“You gossiped and spread this confidential information about (the person) - a very nasty thing to do, not with your eyelash technician, who’s a friend, but also to others (close to the person).

“When people go to hospital, they put their trust in hospitals and you have breached that in a very severe way.”

Despite having no prior criminal history, Magistrate Vasta said the offending could not be overlooked.

“We’ve got to send a message out there to people - you just can’t access … for just having a little sticky beak to see what (the victim) is doing, but to actually then report it to Child Safety, to disclose it to friends,” she said.

The court was told the worker had since lost their job and had faced significant personal hardship, including homelessness.

The defendant was now engaged in full-time work, receiving mental health support, and attempting to rebuild their life.

“You’re only 20, and when you started committing these offences, I think you were about 18,” Magistrate Vasta said.

“I’m going to give you the benefit of no conviction, because I think if we want you to be a productive member of society and earn a living and pay your taxes, then a conviction would be counter-productive to that, and I think it would also be counter-productive to your mental health.”

The worker was sentenced to 180 hours of community service and ordered to pay $1000 in compensation.

A no-contact order was also imposed, with strict conditions around future communications.

“There’s some things you just can’t bring back,” Magistrate Vasta said.

“You can’t take back all of that gossip that you’ve put out there. I suppose from this point, all you can do is keep moving forward and get your hours of community service done and write that very sincere letter of apology.”