Health Care Complaints Commission v Oliver [2026] NSWCATOD 25;

1. The Commission seeks alternative protective orders under s 149A (caution, reprimand or counselling), s 149B (fine) or s 149C (suspension) of the National Law (NSW) in the event that only some of the particulars of the amended complaint are proved.
2. The Commission also requested a direction that the name and address of the witnesses listed in the schedule to the Complaint attached to the amended application not be disclosed under cl 7 of Sch 5D of the National Law (NSW), or an order prohibiting the disclosure of the name of the person listed in the Schedule to the attached complaint under s 64 of the Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act).
3. We must first determine whether the complaints against the practitioner in the amended application have been proved and, if so, what orders, if any, should be made. The Commission bears the onus of proof of the complaints. It is well established that the standard of proof in disciplinary proceedings is on the balance of probabilities with a sufficient degree of certainty having regard to the seriousness of the allegations made, such that the Tribunal must be comfortably satisfied about the allegations made (the Briginshaw test): Briginshaw v Briginshaw (1938) 60 CLR 336, [1938] HCA 34; Gautam v Health Care Complaints Commission [2021] NSWCA 85.
4. We have decided to make the orders sought as outlined in [2] (1)−(4) above because we are satisfied that the complaints particularised in the amended application are established, that the practitioner is guilty of unsatisfactory professional conduct and that this conduct is sufficiently serious to amount to professional misconduct by the practitioner. We are further satisfied that a disqualification of 12 months is appropriate in the circumstances of this case and if the practitioner was still registered, we would have cancelled her registration. We have also made an order for a non-review period for 12 months. We have ordered that the practitioner pay the Commission's costs, as agreed or assessed, under cl 13 of Sch 5D of the National Law (NSW). A direction has also been made for non-disclosure under cl 7 of Sch 5D of the National Law (NSW). Our reasons follow.

1. The practitioner was first registered as a registered nurse in New South Wales on or about 21 August 1975. She completed her training at the Royal Alexandra Hospital for Children and around 1993 started working as a registered nurse in the Western Sydney Local Health District at Westmead Hospital. She worked at Westmead Hospital at material times in respect of the complaints alleged by the Commission.
2. The practitioner was working as a registered nurse at Westmead Hospital between 29 July 2016 and 20 March 2024. As part of her role, the practitioner had access to electronic health records of patients being treated in the NSW health system. She was required to access those electronic records, also known as eMR, to perform her duties as a registered nurse.
3. The Commission contends that the practitioner was subject to various NSW Health policies and procedures while employed at Westmead Hospital, including the NSW Health Code of Conduct, as varied from time to time, Part 11 of the NSW Health Privacy Manual for Health Information, published March 2015, and the NSW Health Care Records Documentation and Management Policy. It is also contended that the practitioner was subject to the Nursing and Midwifery Board of Australia's (NMBA) Code of professional conduct for nurses, effective from 7 May 2013, and then the Code of conduct for nurses, published March 2018, as varied from time to time. These codes of conduct, policies and manuals set out the obligations of health practitioners, including registered nurses, in relation to privacy and the use and disclosure of the health records and personal information of persons within the NSW health system. The Commission contends that the practitioner, and there is no dispute about this, was required to comply with these codes of conduct, policies and manuals when accessing the electronic health records of patients.
4. In April and May 2012, the practitioner completed two training courses about privacy and on 22 May 2012, she signed the NSW Health Code of Conduct and agreed to comply with the Code. She completed further privacy training on 29 July 2014. This is not in dispute.
5. It is alleged by the Commission that from 2016 to 2023, the practitioner inappropriately accessed the electronic health records of her relative (who will be referred to as "Person A" in this decision), inappropriately accessed her own electronic health records on 10 November 2023 and 13 and 20 March 2024, inappropriately accessed another person's electronic health records (referred to in the amended complaint as "Person B") on 18 March 2024 and inappropriately shared those records with Person A.
6. A complaint was made to the Australian Health Practitioners Regulation Authority (AHPRA) by the Western Sydney Local Health District on 11 April 2024 and on 6 May 2024, the practitioner provided a response acknowledging that she had accessed certain medical records. On 11 June 2024, the Commission invited the practitioner to provide a response to the complaint. She did this in July 2024. After this, the practitioner was requested to attend an interview with the Commission, which she attended on 1 August 2024. The Commission finalised its investigation after the interview and on 21 January 2025 sent its findings to her, inviting the practitioner to respond. The Commission found that the practitioner had engaged in improper or unethical behaviour in the practice of nursing by improperly accessing electronic health records.
7. On 19 May 2025, the practitioner informed the Commission that she was not renewing her nursing registration, which was due to expire on 30 June 2025.
8. On 12 June 2025, the Commission filed with the Tribunal an Application for disciplinary findings and orders against the practitioner. The original application sought cancellation of the practitioner's registration with a non-review period of 12 months, together with costs. Given the practitioner's registration expired on 30 June 2025 and she had not renewed her registration, the Commissioner amended the application which is above outlined. This is the application now before the Tribunal.
9. The Tribunal made directions on 16 July 2025, which included directions that the parties were to give to the Tribunal and the other party any material to be relied on. The practitioner was also directed to file and serve a Reply to the Amended Application on or before 24 September 2024. She did not serve a Reply on the Tribunal, although she served the Reply on the Commission in accordance with the directions. The practitioner did not file and serve any material prior the hearing.
10. On the morning of the hearing, the practitioner provided to the Tribunal a Reply to the amended application to the following effect:

"I agree that I breached the code of conduct also the Privacy Act. With Person A there are many reasons why I looked at his file

NCAT have all the information against me. I also live with every day with what I have done. I am ashamed that this has gone so far.

I also live on the pension now.

Person A (sic) I only looked at CT scan. I have an active AVO on Person B."

1. The hearing on 12 November 2025 proceeded as a combined Stage 1 and Stage 2 hearing, and on the basis that the two complaints made by the Commission were not denied by the practitioner.
2. The practitioner participated in the hearing. She gave evidence and was cross examined by the Commission. She also made oral submissions at the end of the hearing. The Commission was represented by Ms Bayley, solicitor advocate for the Commission.

1. The National Law (NSW) establishes a national registration and accreditation scheme for the regulation of health practitioners and the registration of students undertaking programs of study that provide a qualification for registration in a health profession or clinical training in a health profession.
2. Section 3(2) of the National Law (NSW) sets out the objectives of the national registration and accreditation scheme. Section 3(2)(a) relevantly states that one of objectives of the National Law (NSW) is:

to provide for the protection of the public by ensuring that only health practitioners who are suitably trained and qualified to practise in a competent and ethical manner are registered;...

1. Section 3A of the National Law (NSW) sets out the guiding principles in New South Wales and subs (1) provides that the main guiding principle is that the protection of the health and safety of the public must be the paramount consideration. Section 3B states:

In the exercise of functions under a NSW provision, the protection of the health and safety of the public must be the paramount consideration.

1. Section 39 empowers the National Board, in this case relevantly the NMBA, to develop and approve codes and guidelines to provide guidance to the health practitioners it registers and about other matters relevant to the exercise of its functions. The codes of conduct referred to in [9] were developed and approved by the NMBA pursuant to s 39.
2. Part 8 of the National Law (NSW) contains provisions dealing with the health, performance and conduct of health practitioners.
3. Section 139B(1), which is in Div 1 of Part 8, defines "unsatisfactory professional conduct" of a health practitioner to include conduct significantly below reasonable standard (s 139B(1)(a)), contravention of the National Law (NSW) or regulations (whether or not the practitioner has been prosecuted for or convicted of an offence in respect of the contravention) (s 139B(1)(b)), contravention of conditions of registration or undertaking (s 139B(1)(c)) and, relevant to the facts of this case, other improper or unethical conduct (s 139B(1)(l)).
4. Section 139E sets out the meaning of "professional misconduct" as follows:

For the purposes of this Law, professional misconduct of a registered health practitioner means -

(a) unsatisfactory professional conduct of a sufficiently serious nature to justify suspension or cancellation of the practitioner's registration; or

(b) more than one instance of unsatisfactory professional conduct that, when the instances are considered together, amount to conduct of a sufficiently serious nature to justify suspension or cancellation of the practitioner's registration.

1. Div 3, Part 8 of the National Law (NSW) deals with complaints against a health practitioner. A complaint can be made to a Council or the Commission (s 144C). In this case, a complaint about the practitioner was referred to the Commission and by letter dated 11 June 2024, the Commission notified the practitioner that the complaint was being investigated.
2. Sections 149 to 149E of the National Law (NSW), which are contained in Part 8, set out the disciplinary powers of the Tribunal in relation to a registered health practitioner. Section 149 provides that, if a complaint proved or admitted:

The Tribunal may exercise any power conferred on it by this Subdivision in relation to a registered health practitioner or student if -

(a) it finds the subject-matter of a complaint against the practitioner or student to have been proved; or

(b) the practitioner or student admits to it in writing to the Tribunal.

1. Section 149A(1) sets out the general powers of the Tribunal in relation to a registered health practitioner as follows:

(1) The Tribunal may do any one or more of the following in relation to the registered health practitioner -

(a) caution or reprimand the practitioner;

(b) impose the conditions it considers appropriate on the practitioner's registration;

(c) order the practitioner to seek and undergo medical or psychiatric treatment or counselling (including, but not limited to, psychological counselling);

(d) order the practitioner to complete an educational course specified by the Tribunal;

(e) order the practitioner to report on the practitioner's practice at the times, in the way and to the persons specified by the Tribunal;

(f) order the practitioner to seek and take advice, in relation to the management of the practitioner's practice, from persons specified by the Tribunal.

1. Section 149A(3) provides that if the health practitioner is no longer registered, an order or direction may still be given under this section but has effect only -

(a) to prevent the practitioner being registered unless the order is complied with; or

(b) to require the conditions concerned to be imposed when the practitioner is registered.

1. The Tribunal may fine a registered health practitioner under s 149B if the registered health practitioner is found by the Tribunal to have been guilty of unsatisfactory professional conduct or professional misconduct; and it is satisfied there is no other order, or combination of orders, that is appropriate in the public interest.
2. Section 149C sets out the circumstances when the Tribunal may suspend or cancel registration of a registered health practitioner or student as follows:

(1) The Tribunal may suspend a registered health practitioner's registration for a specified period or cancel the registered health practitioner's registration if the Tribunal is satisfied -

(a) the practitioner is not competent to practise the practitioner's profession; or

(b) the practitioner is guilty of professional misconduct; or

(c) the practitioner has been convicted of or made the subject of a criminal finding for an offence, either in or outside this jurisdiction, and the circumstances of the offence render the practitioner unfit in the public interest to practise the practitioner's profession; or

(d) the practitioner is not a suitable person for registration in the practitioner's profession.

(2) The Tribunal may suspend a student's registration for a specified period or cancel the student's registration if the Tribunal is satisfied -

(a) the student has been convicted of or made the subject of a criminal finding for an offence, either in or outside this jurisdiction, and the circumstances of the offence render the student unfit in the public interest to undertake clinical training in the health profession; or

(b) the student is otherwise not a suitable person to undertake clinical training in the health profession.

(3) The Tribunal must cancel a registered health practitioner's or student's registration if the Tribunal is satisfied the practitioner or student has contravened a critical compliance order or condition.

(4) If the person is no longer registered, the Tribunal may -

(a) decide that if the person were still registered the Tribunal would have suspended or cancelled the person's registration; and

(b) if the Tribunal would have cancelled the person's registration, decide that the person is disqualified from being registered in the health profession for a specified period or until specified conditions have been complied with; and

(c) require the National Board with which the person was registered to record the fact that the Tribunal would have suspended or cancelled the person's registration in the National Register kept by the Board.

(4A) If the Tribunal decides under subsection (4)(a) that if the person were still registered the Tribunal would have suspended the person's registration, the person may not apply for registration in the health profession during the period for which the person would have been suspended if registered.

(5) If the Tribunal suspends or cancels a registered health practitioner's or student's registration and it is satisfied the person poses a substantial risk to the health of members of the public, it may by order (a prohibition order) do any one or more of the following -

(a) prohibit the person from providing health services or specified health services for the period specified in the order or permanently;

(b) place specified conditions on the provision of health services or specified health services by the person for the period specified in the order or permanently.

...

(5A) The power of the Tribunal to make a prohibition order under subsection (5) extends to a person who is no longer registered if the Tribunal decides under subsection (4) that it would have suspended or cancelled the person's registration if the person were still registered.

(6) If the Tribunal is aware a registered health practitioner or student in respect of whom it is proposing to make a prohibition order is registered in a health profession other than the health profession in respect of which the Tribunal is making the order, the Tribunal must, before making the prohibition order -

(a) notify the Council and the National Board for that health profession, and the Commission, of the proposed order; and

(b) give the Council, National Board and Commission an opportunity to make a submission.

(7) An order may also provide that an application for review of the order under Division 8 may not be made until after a specified time.

1. Section 149E provides that where a cancellation or disqualification decision has been made by the Tribunal against a person, that person cannot make an application for registration as a health practitioner unless the Tribunal has made a reinstatement order under section 163B of the National Law (NSW).

1. Included in the Commission's bundle of tender documents are the following codes of conduct and guidelines in respect of which the Commission contends the practitioner was obliged to comply at all relevant times:

(1) NMBA Code of professional conduct for nurses, extracts being Introduction and Conduct Statement 5 (effective from 7 May 2013 to 28 February 2018).

(2) NMBA Code of conduct: June 2022, extracts being Index and Principle 3.5 (effective from 1 March 2018).

(3) NSW Health Code of Conduct, relevant extracts being Index and Part 4.5 (effective from 16 December 2015).

(4) NSW Health Privacy Manual for Health Information: March 2015, Parts 11 and 16.

(5) NSW Health - Health Care Records, Documentation and Management (effective from 21 December 2012).

1. The NSW Health Code of Conduct provides that the code defines the standards of ethical and professional conduct that are required of everyone working in NSW Health in any capacity. Clause 4.5.1 states that staff must:

"Keep confidential all personal information and records, including not discussing or providing information on social media that could identify patients or divulge patient information"

"Not disclose, use or take advantage of information obtained in the course of official duties, including when they cease to work in NSW Health."

1. The NMBA Code of professional conduct for nurses, effective from 7 May 2013 to 28 February 2018, states that the code sets the minimum standards for practice that a professional person is expected to uphold in order to ensure the "good standing" of the nursing profession. Relevantly, Conduct Statement 5 provides that nurses must treat personal information obtained in a professional capacity as private and confidential. In the explanatory note, it is stated that the treatment of personal information should be considered in conjunction with the guidelines to the National Privacy Principles 2001 which support the Privacy Act 1988 (Cth). It is further stated that nurses have ethical and legal obligations to protect the privacy of people requiring and receiving care.
2. In Principle 3.5 of the NMBA Code of conduct, effective from 1 March 2018, under the heading 'Confidentiality and Privacy', it is stated that:

"Nurses have ethical and legal obligations to protect the privacy of people. People have a right to expect that nurses will hold information about them in confidence, unless the release of information is needed by law, legally justifiably under public interest considerations or is required to facilitate emergency care."

1. Notably, Principle 3.5 also provides that nurses must respect the confidentiality and privacy of people by seeking informed consent before disclosing information and must access records only when professionally involved in the care of the person and authorised to do so.
2. The NSW Health Privacy Manual for Health Information (the Manual) sets out information about the health privacy principles and the privacy laws and, relevantly, contains Part 11 which deals with the use and disclosure of personal health information. Part 11 provides that the health service may use or disclose information it has collected for the purpose for which it was collected and the "primary purpose" is to provide a health service. Clause 11.2 notes that a health service may also use or disclose information for a "secondary purpose" which is covered by the exemptions under the health privacy principles. These secondary purposes are use or disclosure: for a directly related purpose, to which the individual has consented, to prevent a serious threat to health or welfare, for management, training or research purposes, to assist in finding a missing person, as part of investigating and reporting wrong conduct, to or by a law enforcement agency or investigative agency or on compassionate grounds. The Manual then goes on to provide explanation in relation to each of these secondary purposes. The secondary purpose of use and disclosure to prevent "a serious and imminent threat to health or welfare" permits use and disclosure if there are reasonable grounds for believing this is necessary to lessen or prevent a serious and imminent threat to life, health or safety of the individual or another person or a serious threat to public health or public safety.
3. Part 16 of the Manual contains the policy and guidance in relation to electronic health information management systems. Relevantly, clause 16.3 of the Manual states:

"Electronic systems facilitate access to personal health information. Staff and health providers should be aware of their obligation to restrict access to what is clinically necessary for the patient care, or otherwise authorised under the law. Systems to audit user access and protect security to ensure compliance with these obligations should be in place."

1. Clause 3.3 sets out access protocols and notes that access to electronic health information management systems should be provided on a "needs only" basis.
2. The NSW Health-Health Care Records, Documentation and Management Policy contains the policy for the documentation and management of healthcare records. The Policy notes that health care personnel are responsible for maintaining their knowledge, documentation and management of healthcare records. Clause 1.3 provides that all information in a patient/client healthcare record is confidential and subject to prevailing privacy laws and policies. It is further noted that healthcare personnel should only access a healthcare record and use or disclose information contained in the record when it is directly related to their duties and is essential for the fulfilment of those duties as provided under the legislation.

1. The Commission requested a direction that the name and address of the witnesses listed in the schedule to the Complaint attached to the amended application not be disclosed under cl 7 of Sch 5D of the National Law (NSW). In the alternative, the Commission requested an order prohibiting the disclosure of the name of the persons listed in the schedule to the Complaint attached to the amended application under s 64 of the NCAT Act.
2. Clause 7 of Sch 5D provides that in proceedings before the Tribunal, if the presiding person thinks it appropriate in the particular circumstances of the case, a direction may be made that the name and addresses of any witnesses not be disclosed in the proceedings and/or not be published. Section 64(1) of the NCAT Act gives the Tribunal the power to restrict disclosures concerning proceedings before the Tribunal, including order prohibiting or restricting the disclosure of the name of any person. In Puri v Medical Council of New South Wales [2024] NSWCATOD 87, Deputy President Seiden SC DCJ found that where the Tribunal is considering a non-disclosure and non-publication order in circumstances where the panel is constituted in a proceeding under the National Law (NSW), the person presiding would exercise the power under Clause 7 and not Section 64, which, according to Seiden DCJ at [135], is "ousted at that point".
3. It is accepted that a non- disclosure and non-publication order should be made as requested and this direction was made by the presiding member at the hearing.

1. There are two complaints made by the Commission in the amended complaint. Those complaints, together with the particulars, are set out below.

1. The practitioner is guilty of unsatisfactory professional conduct under section 139B(1)(I) of the National Law (NSW) in that the practitioner has engaged in improper or unethical conduct relating to the practice or purported practice of nursing.

1. From 2016 to 2023 as set out in Annexure A**,** the practitioner inappropriately accessed the electronic health records of Person A in circumstances where she knew she was not required to do so for the purpose of carrying out her work duties or any other authorised purpose. Annexure A sets out the dates of access by the practitioner and records 121 incidents between 29 July 2016 and 18 April 2023 where it is alleged the practitioner inappropriately accessed Person A's electronic health records (Particular 1).
2. On 18 March 2024, the practitioner inappropriately accessed the electronic health records of Person B in circumstances where she knew she was not required to do so for the purpose of carrying out her work duties or any other authorised purpose (Particular 2).
3. On 18 March 2024, the practitioner inappropriately shared information from the electronic health records of Person B with Person A where she knew she was not required to do so for the purpose of carrying out her work duties or any other authorised purpose (Particular 3).
4. On 10 November 2023, 13 March 2024 and 20 March 2024, the practitioner inappropriately accessed her own electronic health records where she knew she was not required to do so for the purpose of carrying out her work duties or any other authorised purpose (Particular 4).

1. The practitioner is guilty of professional misconduct under section 139E of the National Law (NSW) in that the practitioner has:

(i) engaged in unsatisfactory professional conduct of a sufficiently serious nature to justify suspension or cancellation of the practitioner's registration, and/or

(ii) engaged in more than one instance of unsatisfactory professional conduct that, when the instances are considered together, amount to conduct of a sufficiently serious nature to justify the suspension or cancellation of the practitioner's registration

1. Particulars 1 and 3 of Complaint One are repeated and relied upon individually and in combination.
2. Particulars 1 - 4 of Complaint One are repeated and are relied upon in combination.

1. The Commission relies on material in its tender bundle comprising:

(1) The codes of conduct, guidelines and policies referred to above.

(2) Documents provided by the Western Sydney Local Health District (WSLHD) from NSW Health from 2017 to 25 July 2023.

(3) Complaint from the Westmead Hospital to AHPRA dated 11 April 2024.

(4) Documents relating to the Commission's investigation, including a report provided by the practitioner's treating psychiatrist dated 24 October 2024, a letter from the Commission to the practitioner to appear at an interview with the Commission and the transcript of that interview dated 1 August 2024.

(5) Documents provided by the practitioner or relating to the practitioner, including correspondence between the Commission and the practitioner, prior to and after the application and amended application were filed by the Commission.

(6) My learning transcript for the practitioner printed on 17 July 2024 outlining training undertaken by the practitioner from 30 July 2010 to 20 October 2023.

(7) Medical records comprising medical records from Westmead Hospital for the practitioner and various medical records for Person A and Person B and other sensitive medical records, including a treatment agreement, relating to Person A.

(8) Electronic access records comprising access reports or records from July 2016 to July 2017 and for various periods from November 2017 to 20 March 2024.

(9) Records from NSW Police, being fact sheets and charges against Person A.

(10) Evidentiary certificates relating to the practitioner, being a certificate from the Nursing and Midwifery Council of NSW dated 18 July 2025 and a certificate from AHPRA dated 4 November 2025.

1. In summary, these documents disclose the following matters.
2. The practitioner completed privacy training in April 2012, July 2014 and March 2023. She completed training on eMR: Accessing Patient charts in May 2017 and 'Code of Conduct' training in September 2018. The practitioner signed the NSW Health Code of Conduct on 22 May 2012 which included on the signing page the obligation in cl 4.5.4. On the signing page immediately above her signature was a statement by the practitioner that she had read and understood the Code of Conduct and agreed to comply with the provisions at all times while working in NSW Health.
3. According to access logs provided from NSW Health's records, the practitioner accessed the electronic health records of Person A between 29 July 2016 and 18 April 2023 on 121 occasions. There is no dispute about these records. The practitioner accessed the electronic health records of Person A for each year from 2016 to 2023 as follows:

(1) between 29 July 2016 and 20 December 2016 on 23 occasions.

(2) between 16 January and 10 November 2017 on 20 occasions.

(3) between 11 December 2018 and 21 December 2018 on 7 occasions.

(4) between 28 February 2019 and 20 August 2019 on 11 occasions.

(5) between 10 March 2020 and 15 December 2020 on 16 occasions.

(6) between 20 May 2021 and 26 October 2021 on 14 occasions.

(7) between 7 June 2022 and 24 November 2022 on 17 occasions.

(8) between 16 January 2023 and 18 April 2023 on 13 occasions.

1. Person A was not a patient of the practitioner at the time she accessed these electronic health records. There is no evidence that the practitioner was requested or authorised to access these records for the purpose of carrying out her work duties or for any other authorised purpose.
2. In around July 2017, Person A was a patient in a hospital (other than Westmead Hospital). The practitioner visited him. She did not have a power of attorney or enduring guardianship over Person A and was not his carer at this time. She accessed Person A's medical records at the time he was in the hospital and copied and kept those records. The practitioner subsequently approached a staff member on his treating team and advised that she did not like what had been written in Person A's healthcare record.
3. On or about 4 October 2017, WSLHD provided her with an investigation report relating to her access of Person A's medical records in July 2017. The report recorded that the practitioner had accessed the electronic medical records of Person A as an inpatient at the Cumberland Hospital and that an access audit report was run which showed that the practitioner had accessed Person A's records on 42 days between 29 July 2016 and 17 July 2017. The report found the practitioner had breached the Health Records and Information Privacy Act 2002 (NSW) (Privacy Act), the NSW Health Code of Conduct and the Codes of conduct for nurses. The documents referred to in the report were attached to the report provided to the practitioner.
4. The practitioner responded on 3 November 2017 with a handwritten response of six pages. She attached a report from her treating psychiatrist, Dr David Koziol dated 2 November 2017.
5. In her response, the practitioner acknowledged she had accessed Person A's medical records and stated that she was extremely sorry for her actions. She further stated that she "felt ashamed" of the situation and was "regretful" of her actions. The practitioner confirmed that she had approached Person A's treating team after accessing the records. The letter also referred to reasons why she had done this relating to concerns about Person A following previous interactions with police. The applicant explained that she accessed Person A's medical records because she had attempted unsuccessfully to speak with his treating team on a number of occasions. The practitioner further stated:

"This has been an eye opener of what other people etc staff in Western Sydney area sometimes access their relative's information.

I know that... That I didn't follow the correct procedure to gain medical information of a person who you are the carer of."

1. Dr Koziol wrote that the practitioner had been a patient since January 1989. He understood she had been accused of misconduct by accessing Person A's electronic medical records on multiple occasions "over the past year or so" without appropriate authority. He stated that the practitioner admitted to him she was guilty of this misconduct. Dr Koziol stated that he was writing on the practitioner's behalf to put forward what he considered may be mitigating circumstances to explain her behaviour. Dr Koziol stated that the practitioner had an "overly involved, codependent relationship" with Person A throughout his life. The practitioner had struggled to do her best to deal with Person A and her approach had been "misguided for most part but she was unable to respond differently in the circumstances". She had numerous admissions to hospital herself over the past 28 years.
2. On 9 November 2017, the practitioner received a written 'first and final warning' for inappropriately accessing Person A's medical records. The letter stated that the preliminary outcome included a recommendation to terminate the practitioner's employment, but it was noted that the outcome had been downgraded based on information provided by the practitioner. Instead, the final outcome was to be a first and final warning, verbal counselling, a reminder of the practitioner's obligations, including a read and re-sign of the code of conduct, and regular three-monthly auditing of her electronic access. The reminder obligations declaration included a declaration that the practitioner would comply with all applicable NSW Health policies and procedures and observe all laws, professional codes of conduct and ethics relating to her profession. The obligations reminder declaration also included a declaration that she would keep confidential all personal information and records and that she would not disclose, use or take advantage of information obtained in the course of official duties, including when she ceased to work in NSW Health. The declaration was signed by the practitioner on 14 November 2017 and was co-signed by her manager and a witness on the same day.
3. On 4 August 2022, Person A was admitted to Westmead Hospital. He was discharged on 23 August 2022. The practitioner was not part of his treating team. She accessed his electronic health records for his treatment at Westmead Hospital on 4, 5, 8, 9, 10, 11, 12 15, 17, 18, 19, 22 and 23 August 2022. On 7 August 2022, the medical officer treating Person A prepared a summary of Person A's medical history as reported by the practitioner and noted her request for an update to be provided to her about his condition. The practitioner visited Person A on 11 August 2022, and the medical officer updated her about Person A's medical care. She discussed with the hospital social worker concerns about Person A level of care and later spoke with the social worker in the presence of Person A at the hospital bed. On 15 August 2022, the hospital medical officer updated the practitioner about Person A's medical care. When Person A was discharged the medical officer prepared a discharge letter for the treating doctor and the social worker telephoned the practitioner and informed her that Person A would be transferred back into custody.
4. On 15 November 2022, Person A was admitted to a hospital (again not Westmead Hospital). The practitioner accessed Person A's electronic health records leading up to and after this admission. She accessed Person A's electronic health records on 13 occasions from January to 18 April 2023.
5. On 25 May 2023, the Deputy Director of Nursing at Westmead Hospital spoke to the practitioner about audits showing that the practitioner had accessed Person A's electronic medical records. She was advised that a review would be undertaken and was asked not to access any medical records relating to Person A or any other person that was not a direct patient in her care. This is recorded in a risk assessment report dated 22 May 2023. It is recorded that the practitioner agreed not to access any medical records relating to Person A or any other person.
6. On 14 July 2023, the Deputy Director of Nursing emailed the practitioner asking her to provide a statement about why she had accessed Person A's medical records. The practitioner emailed her explanation to the Deputy Director of Nursing on 25 July 2023. In her email, the practitioner stated that there were "many reasons" why she accessed Person A's electronic health records. It is apparent that when the practitioner accessed Person A's records in August 2022, Person A was in custody and was transferred to Westmead Hospital for treatment. The practitioner states that she had permission to visit Person A while Person A was in hospital in the presence of correctional officers. According to the practitioner, the medical staff were not very helpful with Person A's care, and the only way did she could know that he was being cared for in hospital was to access his file. She had requested many times to speak to the treating team, but no one would return her telephone calls or requests, and this was the only way that she could find out about his medical condition.
7. Person A was not a patient of the practitioner at the time she accessed the electronic health records referred to above. There is no evidence that the practitioner was accessing these records for the purpose of carrying out her work duties or for any other authorised purpose. She does not contend that this was the case and instead provides an explanation for the reasons why she accessed the records in her written response to various formal complaints and investigations and in her evidence to the Tribunal, outlined later in these reasons.
8. On 9 March 2024 there was an incident between Person A and Person B where Person B was injured. The circumstances of this incident are set out in the police fact sheet dated 17 April 2024 recording an incident where Person B was allegedly assaulted by Person A and was subsequently taken to Westmead Hospital for treatment. Person A was arrested on 17 April 2024 and subsequently charged with offences in relation to these various incidents. Person B was admitted to Westmead Hospital on 9 March 2024 and was discharged later that day following tests and various scans. According to the discharge summary, a scan showed a fracture to Person B's face. Ambulance records included in the tender bundle reveal that Person B was discharged against medical advice and picked up from the hospital by the practitioner. The medical records reveal that Person B returned to Westmead Hospital reporting a physical altercation with the practitioner. The practitioner also presented to the Westmead Hospital on 9 March 2024 following an alleged physical assault by Person B. She was discharged the following day after treatment and various X rays.
9. Following this incident, the practitioner accessed her own electronic health records on 13 March 2024 in relation to her treatment and discharge on 9 and 10 March 2024.
10. On 18 March 2024 the practitioner accessed the electronic health records of Person B relating to Person B's treatment in Westmead Hospital and the results of a scan. On that day, she shared this information with Person A. There is no dispute that the practitioner accessed Person B's electronic health records, although in her evidence to the Tribunal she said she did not actually read them. Nor is there dispute that she accessed this information at the request of Person A and shared certain information with him. This was confirmed by the practitioner in an interview conducted by the Commission under s 34A of the Health Care Complaints Act 1993 (NSW), which gives power to the Commission to obtain Information records and evidence when investigating a complaint. The practitioner gave evidence about this in her evidence to the Tribunal, set out in more detail below.
11. Notwithstanding the requests made by the Deputy Director of Nursing on 25 May 2023, the practitioner accessed her own electronic health records on 10 November 2023, 13 March 2024 (in the circumstances outlined above) and on 20 March 2024 and she accessed the electronic health records of Person B on 18 March 2024 and shared them with Person A.
12. Person B was not a patient of the practitioner at the time she accessed her electronic health records referred to above. There is no evidence that the practitioner was accessing these records for the purpose of carrying out her work duties or for any other authorised purpose. Nor is there evidence that the practitioner was accessing her own electronic health records for the purpose of carrying out her work duties or for any other authorised purpose She does not contend that this was the case. Her explanation for the reasons why she accessed the records are in her interview with the Commission and in her evidence to the Tribunal, outlined later in these reasons.
13. On 27 March 2024, practitioner resigned from Westmead Hospital.
14. On 11 June 2024, the Commission sent a letter to the practitioner about a complaint that had been made by Westmead Hospital concerning her conduct. The practitioner was notified that the Commission determined the conduct warranted an investigation. She responded by handwritten letter dated 10 July 2024 attaching a letter she had sent to the Nursing and Midwifery Council of NSW dated 6 May 2024, a reference from a staff specialist who she had worked with as a clinical nurse in his private consulting rooms and her letter of resignation. In her letter, the practitioner outlined her history of work as a registered nurse and stated that because she was leaving Westmead Hospital, she did not think that further action would be taken. She stated that the reason why she looked at her own electronic health records was because she had not been told the results of her pathology report when she was discharged and she wanted to check her blood results. She stated that she looked at Person B's electronic health records because she was concerned about whether Person B had sustained any injuries because she had fallen on her face. The practitioner stated that she had now had an apprehended violence order (AVO) against Person B but did not otherwise explain why she accessed person B's electronic health records.
15. The practitioner said that she wished to remain a registered nurse, but she had made mistakes by looking into her file and the other person's file. She said she felt very ashamed of doing this and that she had let her fellow nurses down.
16. In her letter of July 2024, the practitioner again said that she thought resigning from the hospital would mean that no further action would be taken. She stated that she had let her colleagues down and that she was ashamed of breaking the Privacy Act. The practitioner further stated that the only person that had been hurt was herself.
17. Included in the tender bundle was a notice from the Commission dated 22 July 2024 to the practitioner to appear for an interview on 1 August 2024, a letter to the practitioners psychiatrist (Dr Koziol) requesting information in relation to the practitioner, a letter from Dr Koziol dated 24 October 2024 and the transcript of the interview of the practitioner held by the Commission on 1 August 2024.
18. Dr Koziol reported that the practitioner had been under his care since January 1989. He stated that most of her admissions to hospital occurred in the 1990s with occasional readmissions in the past 10 years which were precipitated by severe psychological stress and seemed appropriate to the problems caused by Person A. He observed that the practitioner's relationship with Person A continued to the day of his report and appears to be a "direct contributing factor" to her breach of privacy in March 2024. D Koziol was asked to opine on the practitioner's current fitness to practise as a registered nurse. He stated that he had never been aware of problems with her competence in the workplace and that her misbehaviours had almost exclusively been related to her relationship with Person A. He described this relationship as "intractable and unamenable to intervention over the years and continues and will very likely continue for life".
19. In her interview with the Commission on 1 August 2024, the practitioner said she had been given information about privacy information handling and confirmed that she had understood the information she was given about the privacy training. She also confirmed that she had been given information about the code of conduct as it related to nurses and midwives and said she "did not read all of it" but read some of it. She was asked about the investigation into accessing electronic health records of Person A in 2017 and she explained the reason why she had done this was because she had a number of AVOs against Person A and there were occasions when he was in custody, but she wanted to follow up his care by looking online at his treatment. She agreed she had physical access to Person A when he was in hospital, but she wanted to access his electronic health records because she felt there was neglect and that she needed to follow up. The practitioner was asked whether this was contrary to the code of conduct about accessing medical records and she said that this had only come in on 1 July of last year (namely 2023) and she had not been told anything before that time.
20. The practitioner was asked to explain what her knowledge about the NSW Health Code of Conduct was, in particular where she had signed that page of the dealing with confidential information. She said that she did not think she was breaching the Code because Person A was a close relative and there was a lack of duty of care by the nursing staff. She confirmed that she did not have a power of attorney or enduring guardianship over Person A and that she was not a paid carer, but she was Person A's only relative in Sydney. She confirmed that she had accessed Person A's records online. When she was asked about whether she understood after the investigation in 2017 that what she had done was not right, she responded as follows:

"I suppose against the hospital policy, it wasn't right, but to me, because I was not−nobody else was reading it, that it was wrong."

1. The practitioner was asked whether she would access Person A's records again in similar circumstances where she was concerned about his care, she said that she would not. When asked to explain the policy and whether she knew why accessing Person A's electronic health records was against the policy, the practitioner said as follows:

"Ah, I do and I don't. The reason why it's against the policy if you're going to share information with other people in the public. For me [explaining the nature of the relationship] it stays in one little box, you don't disclose other people's medical conditions unless you're with a consultant and at the time with the− so no I wouldn't disclose anything."

1. When the practitioner was asked about accessing information and not just disclosure and why the boundary exists, she said:

"Because some other people could access your information and use it against you. So therefore, yeah no it's I mean I've seen things on TV and people breaching and I sort of think I can't watch that because it reminds me of what I've done and I feel very ashamed and no good."

1. In relation to accessing her own health records, she said that she thought she would have got a discharge summary but because she did not and she was busy on that day she did not want to hassle her specialists for the results. In relation to accessing the information of Person B, the practitioner said the reason why she did this was because Person A was involved and Person B got a fracture. She only accessed the information to "console" Person A.
2. Near the end of the interview the practitioner said that she now understood if she was ever asked to access any health records other than the person she was treating, it was "absolutely no" unless the consultant or the treating doctor asked her to do so. She accepted that she had made an error and that she was "totally ashamed".
3. On 21 January 2025 the Commission wrote to the practitioner putting her on notice that the Commission had formed the view she had engaged in improper and or unethical conduct in the practice of nursing by improperly accessing her own personal health information, improperly accessing Person A's personal health information on multiple occasions and improperly accessing personal Person B's personal health information and disclosing this information to a third party. The practitioner was invited to respond.
4. She responded on 28 January 2025 with a brief handwritten letter stating that she hoped the investigation did not go any further and that this had been a great wake up call for her. She asked for her name to be taken off the NSW registration. She sent a second response by way of email on 13 February 2025 stating that she was "not as corrupt as those nurses on the news" and would they please reconsider her case and that she loved being a nurse and she never "decriminalised" any of her patients.

1. In addition to the various responses made by the practitioner which are included in the tender bundle, the practitioner provided emails in response to the Commission's request on whether she agreed with any of the matters in the complaint. By email dated 29 September 2025, she responded as follows:

"I deny looking at Person B file. The part I looked at from the CT scan result and nothing else in B file. Person A file yes I did look at his file 2016. And ongoing. There is many reasons why I continued checking person A file. Also acceded (sic) my file to get a result so I could talk to the cardiologist that I had seen before. Hope this is enough information. At court I can explain in further details about person A file."

1. The practitioner attended the hearing and made an opening statement to the effect that she was not registered, and she did not intend to apply for registration. She said that she accessed Person A's health records in circumstances where she could not make contact with him because she either had AVOs against him or in circumstances where he was in custody. She was concerned about the health and well-being of Person A and wanted to keep "emotionally connected" to him and follow his progress and treatment. This is why she kept accessing his electronic health records. She wanted to keep accessing Person A's files because Person A had head injuries, had a poor memory and she wanted to keep an eye on Person A to ensure that Person A was able to get legal assistance to access rights. She also said that Person A had seizures. The practitioner submitted that the reason why she accessed the records of Person B related to the circumstances where she had been assaulted by Person B. The practitioner acknowledges that she accessed Person B's scan and she did this because she wanted to feel reassured about the diagnosis and treatment. She knew this was an error. She accessed her own records in March 2024 because she wanted to know about her own results. She did not renew her registration again because she believed it was the right thing not to reregister.
2. The practitioner was cross examined by the solicitor advocate for the Commission. In summary her evidence was as follows:

(1) The practitioner signed the NSW Health Code of Conduct in May 2012 which contains the provision about confidential information. Despite this, the practitioner said that in the early stages she did not consider that accessing Person A's health records was wrong because he was a close relative.

(2) She admitted accessing the records set out in Annexure A to the complaint attached to the amended application, in circumstances where Person A was not her patient and she was not required to do so. She also accepted that she did not otherwise have authorisation to access those records.

(3) The practitioner knew that it was in breach of the relevant codes of conduct but in her heart, she still wanted to access the Person A's health records.

(4) The practitioner acknowledged paragraph 21 of the investigation report dated September 2017, which found that she had breached patient privacy and confidentiality and had failed to ensure compliance with the Registered Nurse Standards for Practice and Code of conduct for a registered nurse. When asked whether she remembered reading this, the practitioner said, "not really". She could remember reading some of it but perhaps not all. The practitioner said that she now realises that it was incorrect to access her own health records.

(5) The practitioner was referred to the written warning that she was given in 2017 and asked whether she realised that accessing electronic health records of Person A was wrong and that this was serious. She said that she did realise this, but she felt she needed to help Person A. This is why she continued to access the electronic health records.

(6) The practitioner was asked whether she had undertaken the privacy training in 2018 and whether she knew she was not able to access Person A's electronic health records. She agreed that she put the needs of Person A ahead of her obligations under the law.

(7) When asked why the practitioner accessed Person A records in August 2022 and why she did not engage directly with hospital staff rather than access the records, the practitioner said she did not trust hospital staff.

(8) The practitioner was taken to the access log at pp 276, 278, 280, 291, 297 and 298 of the tender bundle. These records revealed that the practitioner spent considerable time accessing Person A's records in 2021 and 2023 and the records of Person B in March 2024. The practitioner said that sometimes she printed the records for Person A.

(9) The access log records for March 2024 revealed that the practitioner accessed a scan, progress reports and ambulance sheet for Person B on 18 March 2024. When the practitioner was taken to the access log on 18 March 2024 for person B, she said that she could not recall reading the particular health records. However, the access logs for person B on 18 March 2024 reveal that those records were open for approximately 10 minutes from 2:25 to 2:35pm. The practitioner said that she looked at those records because she wanted to find out about the fall. She agreed that Person A had asked her to look at the health records but denied that she was accessing the records for a long period of time and said that they may have been open, but she was "doing other things" and not reading them.

(10) The practitioner said that while she accessed the records of Person B, she panicked as she knew that she did not need to access these records for her work. She said she could tell that Person B had a fracture because her face was swollen. She worked this out without looking at the scan. After initially saying that she did not look at Person B's scan, the practitioner then said that she did look at it "quickly". The practitioner denied that she accessed the records because she was concerned about Person A being prosecuted. She also said that she did not trust Person B and knew that Person A and Person B were breaking up. She agreed she accessed her own records on 13 March 2024 relating to her hospital admission following the incident between her and Person B.

(11) It was also brought to the practitioner's attention that during her interview with the Commission, she had acknowledged that Person A asked her to find out about Person B's facial injuries. In response to this, the practitioner said another reason why she looked at the records was to see if what Person A had told her about the incident was correct. Person A told her that Person B had fallen on the driveway on her face. She said she did not know at this time that Person A was being charged by police but did know that police and an ambulance had been called. She was "curious" about what had happened.

(12) In relation to her own records that were accessed on 20 March 2024, the practitioner said she wanted to access those records to give information to her cardiologist. She agreed that she should not have accessed those records electronically, but she said she could not wait to access the information. The practitioner was asked why she did not follow up on the results with her general practitioner or specialist and she said she did not want to wait. She also said that she did not want to waste the time of the general practitioner.

(13) The practitioner was asked about the answer she gave during the course of the interview of the Commission on 1 August 2024 to the effect that she knew that after the investigation in 2017 accessing electronic health records "wasn't right" but that because nobody else was reading them "it wasn't wrong". The practitioner reiterated the position that it was not wrong because she had not given access to anybody else to see those records.

(14) The practitioner was asked about whether she had considered making complaints about the hospital rather than accessing Person A's electronic health records because of concerns about his treatment in 2017 and 2022. She said that she did not do this because she did not want to cause trouble, and she believed that complaining would jeopardise Person A's care. The main reason she accessed the reports was so she could explain to Person A what was happening. She agreed that she was not and never applied to be Person A's guardian.

1. The Commission submits that the practitioner inappropriately accessed the electronic health records of a relative on over 120 occasions between 2016 and 2023, that she had inappropriately accessed the electronic records of the family member's partner in 2024 and, even more seriously, shared those records with the family member. She also inappropriately accessed her own electronic health records on three occasions in 2023 and 2024.
2. It is submitted that Complaint One, being the complaint about unsatisfactory professional conduct, is proven and that the Tribunal should consider that this complaint is sufficiently serious to amount to professional misconduct. As such, the Tribunal should find that Complaint 2 is also proven.
3. It is further submitted that in the circumstances of this case, the Tribunal should find that if the practitioner had been registered it would have cancelled her registration and that she should be disqualified for a period of 12 months. The Commission contends that any application for review of the order should not be made for a period of 12 months from the date of the order. The practitioner was very experienced, she had received training about these issues, had re-signed the NSW Health Code of Conduct and had been issued with a formal warning. Despite this, her breaches in inappropriately accessing electronic health records of a relative, an associate of the relative and herself were extensive and significant. The fact that she has a difficult relationship with Person A does not excuse breaches of the privacy law and the relevant codes of conduct. She had other options available. For instance, she could have raised her concerns directly with Person A's medical practitioners. Furthermore, the practitioner does not explain how getting access to Person A's health records would have assisted him. Her justification for this was that she had no confidence in the medical profession.
4. There is no dispute that the practitioner accessed Person B's records. She says that she may have clicked on the record but did not read them. The Commission submits that it is implausible that the practitioner had these records open for 10 minutes and did not read them. Accessing Person B's personal health records when she had no professional reason to do so, suggests that the practitioner put her interests and the interests of Person A before her obligations under the law and of the privacy of Person B.
5. The practitioner's explanation that she accessed her own records because she wanted to save time seeks to minimise the seriousness of the breach and shows a lack of insight about the seriousness of inappropriately accessing the electronic health records system. There is no reason why she could not have waited to contact her general practitioner.
6. The Commission submits that the practitioner has limited insight and she needs an extended period to reflect on her wrongdoing.
7. In her oral submissions at the end of the hearing, the practitioner repeated submissions that she made at the opening and the evidence that she gave about why she inappropriately accessed the electronic health records of Person A, Person B and her own health record. She apologised to the Tribunal for her wrongdoing. The practitioner said that her life had changed since she was no longer a registered nurse. She was not well off financially because she could not work as a registered nurse. The practitioner was giving another relative financial assistance for court actions.

1. It is clear from the above codes of conduct, policies and manuals that health professionals who have access to personal health records of persons being treated in the health system must not only keep that information confidential but must only access those records when professionally involved in the care of the person whose records have been accessed or if otherwise authorised to do so. This applies to both physical and electronic health records and clearly applies to registered nurses. There are exceptions for the disclosure of this information under the law and the guidelines but there is no evidence in this case that the practitioner accessed, used and, in some cases, disclosed this information for the purposes of those exemptions. The principle of confidentiality of patient records is an important matter that underpins the integrity of the health system and is a paramount obligation.
2. The practitioner signed the NSW Health Code of Conduct in 2012 and again in 2017, she received training in relation to the NSW Health Code of Conduct, and privacy law on the importance of handling personal health information. She was given a written warning about these issues in 2017 and was spoken to by the Deputy Director of Nursing in 2023 and asked to refrain from accessing the electronic health records of Person A. At all relevant times, the practitioner was bound by the Code of conduct for nurses.
3. We are satisfied, and so find, that the practitioner accessed the electronic health records of Person A on over 120 occasions between 2016 and 2023 and that this access was inappropriate and was not authorised. Our findings are based on the Commission's documentary evidence set out above, the admissions made by the practitioner in her correspondence of 2017, 2023 and 2024, her statements in the interview on 1 August 2024 and the evidence she gave at the hearing,
4. This was in breach of the NSW Health Code of Conduct and the relevant provisions in the Codes of conduct for nurses effective from 2013 to March 2024.
5. We are also satisfied that the practitioner knew, or ought to have known, that accessing these records was a breach of the law, the relevant codes of conduct and was wrongful and that it was serious. She had attended numerous training sessions on the privacy law, access to electronic health records and the NSW Health Code of Conduct, she had been given written warnings about this, she was required to sign a declaration about her obligations in 2017 as she was spoken to by the Deputy Director of Nursing in 2023.
6. The practitioner made admissions in written correspondence and in her interview with the Commission and gave evidence to the Tribunal that she knew it was wrong. However, she sought to justify and minimise those breaches in much of her explanations and evidence to the Tribunal. There is evidence that the practitioner wanted to use this information to interfere in Person A's care and treatment. This may not have been in Person A's best interests, and it is difficult to understand how the practitioner's expertise would be superior to treating professionals. Relevantly, Dr Koziol opines that the practice of intervention has been long standing, is likely to continue and he describes the practitioner's involvement as "overly involved" and "codependent". He also describes the practitioner's relationship with Person A as "pathological" and "intractable and unamendable".
7. We are also satisfied that the practitioner accessed the electronic health records of Person B on several occasions on 18 March 2024 and that this access was inappropriate and was not authorised. This was in breach of the NSW Health Code of Conduct and the relevant provisions in the Code of conduct for Nurses from 2013 to March 2024. We do not accept the practitioner's denial that she read the health records of Person B. When she was asked to explain to the Commission and the Tribunal what happened, the practitioner's evidence about this is inconsistent. The access logs suggest that the practitioner accessed the electronic health records of Person B for an extended period and her evidence that she did not look at the records is implausible.
8. These breaches were exacerbated by the fact that the practitioner was asked to access the information by Person A, in circumstances where there was an issue about whether Person A would be held criminally liable for the injuries sustained by Person B on 9 March 2024. The practitioner agrees that she discussed this information with Person A, and we are satisfied that she discussed with him at least some of the information contained in Person B's health record. We do not accept that the practitioner went to the trouble to access the record over a week after the incident yet did not read it.
9. We are satisfied that the practitioner accessed her own electronic health records in November 2023 and on two occasions in March 2024. When she accessed her records on 13 March 2024, she did this in the context of interactions between her and Person B and an AVO that she now apparently has against Person B. This suggests that the practitioner was prepared to use her access to electronic health records to further her own position. She accessed her own medical records on 20 March 2024 when she could have easily obtained this information through her general practitioner. She decided not to do this because it was inconvenient. This is despite the fact that she had already been warned about accessing electronic health records.
10. We accept the contention that the practitioner has limited insight in relation to the seriousness of her numerous breaches. She was given a written warning in 2017 and was spoken to by the Deputy Director of Nursing in 2023. She undertook training about privacy, NSW Health Code of Conduct and accessing electronic records in May 2017, September 2018 and March 2023 yet continued to access Person A's electronic health records on no less than 78 occasions, she accessed Person B's electronic health records in relation to a contentious interaction with Person A and provided information to Person A at his request and accessed her own records on three occasions. The practitioner said that she did not read all of the privacy information or the relevant provisions relating to the NSW Health Code of Conduct and she did not understand that accessing the electronic health records in itself was in breach of the codes and the privacy legislation, not just the disclosure of that information. Given the importance to the overall integrity of the health system and the confidence of users that their information be kept continental and private, the practitioner's admission that she did not read the relevant codes of conduct, guidelines and manuals carefully or at all, raises serious concerns.
11. Following the investigation in 2017, the practitioner's access to electronic health records was audited. She was spoken to by the Deputy Director of Nursing in 2023 about her inappropriate access and it was only after this that the practitioner stopped accessing Person A's electronic health records.
12. The practitioner said that she was sorry, remorseful and ashamed in 2017, yet she continued to access electronic health records, not only of Person A but Person B. In response to the findings by the Commission in January 2025, the practitioner accepted that she had accessed electronic health records but did not appear to appreciate the seriousness of this and stated that she believed the Commission would not take it any further if she simply resigned from Westmead Hospital. According to Dr Koziol, the practitioner's breaches are based on long-standing issues with Person A and these issues are likely to continue. Dr Koziol has treated the practitioner for over 30 years, and his opinion carries significant weight.
13. While the practitioner says she does not wish to be re-registered, this is unclear because she has changed her mind on several occasions. We accept that the practitioner is currently not registered but it is unclear whether she will seek to be reregistered in the future, even though she says that she will not.

1. The first step is for the Tribunal to determine whether Complaints One and Two have been proved. If so, it then falls to the Tribunal to determine what protective orders should be made, if any.

Are the particulars in Complaint One proved, and if so, is the practitioner guilty of unsatisfactory professional conduct?

1. Given our findings at [100] - [112] we are comfortably satisfied, and so find, that each of the particulars to Complaint One are established. Relevantly, we find that the practitioner inappropriately accessed electronic health records of Person A, Person B and her own records on at least 120 occasions on a continual or regular basis over a period of 8 years.
2. We are satisfied that this conduct by the practitioner is unsatisfactory professional conduct within the meaning of s 139B(1)(l) of the National Law (NSW) because the conduct relates to her profession as a registered nurse and was improper or unethical.
3. In Health Care Complaints Commission v McCallum [2023] NSWCATOD 170 (McCallum), the Tribunal considered the conduct of a registered nurse, who, among other things, inappropriately and without authority accessed the electronic health records of 8 other persons and herself on multiple occasions. The Tribunal at [104] noted that the words "improper" and "unethical" are not defined in the National Law (NSW) and accepted the proposition that these words should be given their ordinary meaning, citing the Tribunal decision of Health Care Complaints Commission v Liu [2016] NSWCATOD 133 at [51]- [55], which adopted the definitions in the Macquarie Dictionary for "improper" as not proper, not in accordance with propriety of behaviour and unsuitable or inappropriate and "unethical" as contrary to moral precept, immoral or in contravention of some code of professional conduct. The test of whether the conduct is improper is an objective one.
4. In this case, the practitioner accessed Person A's health records on multiple occasions, knowing that this access was contrary to various codes of conduct and policies with which she was required to comply. There is no evidence that she discussed the access with Person A and, while we accept this was intended to be in Person A's best interests, her evidence is that she accessed the records to maintain an emotional connection, to find out what was going on and in circumstances where she was not confident and wanted to challenge Person A's treatment. Under the NMBA Code of conduct for nurses, registered nurses have "ethical and legal obligations to protect the privacy of people" and to recognise that "people have the right to expect nurses will hold information about them in confidence". The practitioner breached this on numerous occasions in circumstances where she had other alternatives. Despite her complaints about obtaining information from Person A's treating team in 2022, there is evidence that she was spoken to on several occasions by members of his treating team.
5. Even more concerning is that the practitioner inappropriately accessed the electronic health records of Person B in circumstances where she must have known, despite her denials, that there may be further legal action. She did this at the request of and for the benefit of Person A, and possibly because of concerns about her own interactions with Person B. On her own admission, the practitioner knew this was wrong.
6. She accessed her own records rather than wait to obtain the information from her doctors and on her own admission, this was for her own convenience.
7. In our view, this conduct over a period of 8 years is objectively improper and unethical, particularly when it is the professional role of a registered nurse to provide care and treatment to people using the NSW health system and to protect their confidential information. Accessing the electronic records without authority and where there is no clinical or therapeutic need undermines the integrity of the healthcare system and has the potential to undermine confidence, which is critical for users who are often vulnerable.

Are the particulars in Complaint Two proved, and if so, is the practitioner guilty of professional misconduct?

1. The Commission repeats and relies on particulars 1 and 3 of Complaint One individually and in combination. The Commission also repeats and relies on particulars 1 to 4 of Complaint One in combination.
2. As already noted, we are satisfied that each of the particulars in Complaint One are proven.
3. Under s 139E of the National Law (NSW), if the practitioner is guilty of unsatisfactory professional conduct this will amount to professional misconduct if that conduct is a sufficiently serious nature to justify suspension or cancellation of registration or if the conduct is more than one instance and those instances, when considered together, are sufficiently serious in nature to justify suspension or cancellation of registration.
4. In Health Care Complaints Commission v Le [2021] NSWCATOD 104, the Tribunal, citing previous authorities, stated at [71]:

"...

(3) Professional misconduct refers to conduct which is sufficiently serious to justify suspension or cancellation of the respondent's registration. The determination of whether conduct amounts to professional misconduct has, as its starting point, an objective assessment of the respondent's conduct against the standard of conduct reasonably expected of an equivalent practitioner. Importantly, the gravity of professional misconduct is not to be measured by reference to the worst case but by the extent to which the conduct departs from 'proper' or 'reasonably expected' standards: Health Care Complaints Commission v Litchfield [1997] NSWSC 297; (1997) 41 NSWLR 630 at 638.

(4) Whether conduct is sufficiently serious to warrant suspension or deregistration is a matter of degree and judgment: Sabag v Health Care Complaints Commission [2001] NSWCA 411 at [82];

..."

1. In Chen v Health Care Complaints Commission [2017] NSWCA 186, Basten JA said at [19] that "professional misconduct" does not have a specific meaning, and it is merely a category of unsatisfactory professional conduct. Basten JA further explained at [20],

"There is no category of unsatisfactory professional conduct which is not capable, depending on the circumstances, of giving rise to professional misconduct and hence engaging the power of either suspension or cancellation of registration. The only requirement is that it be "sufficiently serious" to justify such an order, a characterisation which must depend upon an evaluative judgment made by the Tribunal. Some, perhaps all, categories include conduct which may reveal a defect of character as to which the Tribunal may conclude that the person should not be allowed to practise his or her profession unless at some future date the practitioner is able to satisfy the Tribunal that the defect has been overcome. Incompetence or inadequate care may in some circumstances be remediable by specific steps; in other circumstances the Tribunal may be concerned that the carelessness, for example, is such as to cast doubt on the suitability of the person to practise medicine. Each of the criteria for cancellation or suspension may be analysed in this way. Each case will depend upon an evaluative judgment to be made by the Tribunal as to the nature and seriousness of the conduct. It follows that the legislative scheme is inconsistent with the implication of the abstract condition sought to be imposed by the practitioner on the language of s 149C(1)."

1. The Commission submits that the practitioner's conduct was sufficiently serious to amount to professional misconduct. Health records are tightly regulated to protect the public and before her conduct started the practitioner had already expressly acknowledged the NSW Health Code of Conduct and agreed to comply with it. Her conduct started in 2016 when the practitioner was already a mature and experienced nurse, she had been working at the hospital for over 30 years and had already completed training about privacy.
2. After being detected inappropriately accessing her relative's records, the practitioner was put on notice of the breach and provided with the relevant codes of conduct and policies. She responded to the investigation report 2017 acknowledging access of the health records was wrong and was issued a first and final warning about the conduct. A day after the warning letter, the practitioner again inappropriately accessed Person A's records. Ten months after the warning letter she completed training about NSW Health Code of Conduct and within months, on 11 December 2018, the practitioner again inappropriately access Person A's records and continued to do so on multiple occasions from 2020 to 2023. Within six months after speaking to the Deputy Director of Nursing in May 2023 and being asked to provide an explanation for the inappropriate access of Person A's records the practitioner accessed her own records and within a further four months accessed Person B's records and again accessed her own records.
3. The Commission submits the practitioner's conduct demonstrates a blatant disregard for the fundamental obligation on all registered nurses to maintain patient confidentiality. We accept this submission.
4. We are satisfied that the conduct of the practitioner amounts to professional misconduct for the following reasons:

(1) Client confidentiality and privacy underpin healthcare in New South Wales and across Australia. Patients must be able to trust that the private health information they provide to health professionals, and which is generated in the course of provision of health care, will be securely held and only accessed lawfully and properly. There are very limited circumstances where there is an overriding consideration to access, use and disclose this information. It is the duty of healthcare professionals to use and safeguard health information and only to access this information in the best interests of patients to serve their health needs. Patients in the health system as a whole depend on this professionalism: Health Care Complaints Commission v Aref [2018] NSWCATOD 133 at [53] - [54].

(2) The practitioner has over 40 years' experience as a registered nurse and at the time she commenced inappropriately accessing electronic health records, she had been in practice for over 30 years. She had received training about the obligations of patient confidentiality, and the importance of privacy and confidentiality was incorporated into various codes of conduct and NSW health policies and manuals. She knew and must have known about the importance of these principles and made written admissions about this. Despite this, she attempted to justify those breaches. Her conduct was repeated and we accept it was in blatant disregard of her obligations. Further, we are not satisfied that the practitioner fully appreciates the seriousness of those obligations, and her subsequent conduct suggests she was paying lip service to her earlier expressions of remorse.

(3) There is evidence that the practitioner was accessing the electronic health records of Person B for the benefit of Person A and/or for her own benefit. The reason why she accessed her own records was for her own convenience − there is no suggestion she could not have otherwise obtained this information from her own health professionals. This also demonstrates how little regard she apparently placed on the importance of keeping electronic health records secure.

(4) It may count in her favour that she stopped accessing Person A's records after the discussion with the Deputy Director of Nursing in May 2023, but this did not stop her accessing Person B's records or her own records. This is difficult to understand, and practitioner has not given a good explanation for why she did this.

(5) While all cases turn on their own facts, there are other cases where the Tribunal has found that the repeated unauthorised or inappropriate accessing of electronic health records is sufficiently serious to amount to professional misconduct. For instance, a registered nurse who accessed health records for herself and multiple patients over about eight months, including people relating to her partner, in the context of family court proceedings (Health Care Complaints Commission v Payne [2021] NSWCATOD 145); a registered nurse who inappropriately accessed the records of eight patients and herself, albeit over a limited period, (McCallum); an enrolled nurse who inappropriately accessed her own health records and health records of multiple patients, including her colleagues, family members and relatives, with the Tribunal finding that accessing records of persons of people who she knew was related to "amplified" the seriousness of her conduct (Health Care Complaints Commission v Livermore [2021] NSWCATOD 48) (Livermore) and a formerly registered nurse who inappropriately accessed the health records of multiple patients on 38 occasions (Health Care Complaints Commission v Svensson [2022] NSWCATOD 187).

(6) These Tribunal decisions are consistent with the proposition that accessing electronic health records, even where there is no disclosure but the access and use is for the practitioner's own purposes, is sufficiently serious to amount to professional misconduct. This is what happened in this case.

1. The Commission submits that the protection of public safety and health is paramount (s 3B National Law (NSW)). The objective of protecting health and safety of the public is not confined to protecting patients or potential patients from the practise or incompetence of a particular practitioner. It includes protecting the public from similar misconduct or incompetence of other practitioners. This objective is achieved by setting and maintaining the standards, and, where appropriate, by cancelling registration of practitioners who are not competent or otherwise not fit to practise, including those who have been guilty of serious misconduct. Taking action in relation to such conduct operates as a deterrent to the individual concerned as well as general deterrence for other practitioners. This also maintains public confidence by sending a message to practitioners and to the community that practitioners who engage in conduct that does not meet the requisite standard will not be permitted to practise.
2. The Commission submits that once a finding of professional misconduct is made, the Tribunal has discretion to suspend or cancel, and it is not necessary to make a finding that the practitioner is permanently unfit to practise before registration can be cancelled. The Tribunal also has discretion to make orders that it would have suspended or cancelled the registration if a practitioner is no longer registered. The Tribunal further has discretion to make orders fixing a disqualification period and a non-review period. It is submitted that fixing a non-review period indicates the seriousness of the conduct and reflects general deterrence.
3. The Commission contends that in the circumstances of this case, an order that the Tribunal would have cancelled the practitioner's registration with a 12 month disqualification period is appropriate to denounce the practitioner's conduct, deter the practitioner from similar conduct in the future, deter other practitioners from similar conduct and uphold the high professional standards of the nursing profession because the public has a right to expect that registered nurses will protect their privacy.
4. We accept these submissions.
5. The findings we have made in relation to the question of whether the practitioner's conduct was sufficiently serious to amount to professional misconduct are also relevant to our consideration of what protective orders should be made and how we should exercise our discretion.
6. The confidentiality of patient information is of the upmost importance to the integrity of the health care system and the confidence of the users. Upholding those principles should be reflected in the protective orders made. We have already accepted the proposition that the practitioner's conduct was in blatant disregard of those principles. She continued to breach despite numerous warnings, training and her extensive experience. We are not satisfied from her evidence, which is reinforced by her conduct and the evidence of Dr Koziol, that the practitioner would have stopped inappropriately accessing electronic health records, thereby repeatedly breaching confidentiality, but for the fact her conduct was detected through complaints and an audit of her access to electronic records. For this reason, we would have cancelled the practitioner's registration if she had renewed her registration in June 2025.
7. We accept the submissions of the Commission that the practitioner has limited insight into the seriousness of her conduct and the importance of observing the relevant codes of conduct, policies and manuals in relation to the security and confidentiality of electronic health records. This does not engender confidence that the practitioner would observe those principles in the future.
8. We also agree with the observations of the Tribunal in Livermore that accessing records of people who the practitioner is related to or knows heightens the seriousness of the conduct − there was an element of use and possibly abuse of position in using that information by reason of those particular relationships in the circumstances of this case.
9. We accept that the practitioner did not broadly disseminate this information and that, at least in relation to Person A, her intentions were to act in his best interests. However, this does not excuse or lessen the seriousness of the numerous breaches. It is the conduct of repeated inappropriate accessing of private and personal health records, the continued accessing after repeated warnings and the lack of insight into the seriousness of the conduct which gives rise to the need for protective orders for the future.
10. In our view, an order that we would have cancelled the practitioner's registration sends a message not only to the practitioner but to the community and the profession more generally about the seriousness of the professional misconduct. Orders that the practitioner should be disqualified for 12 months with a non-review period of 12 months, not only ensures that the practitioner cannot reapply until a sufficient period has expired but also sends a message to the community and other practitioners about the seriousness of the practitioner's professional misconduct. Even if the practitioner does seek to reapply, she must first seek reinstatement from the Tribunal under s 163B of the National Law (NSW).

1. The Commission submits that Tribunal's power to order costs is conferred by cl 13, Sch 5D to the National Law (NSW).
2. Clause 13(1) provides that the Tribunal may order the complainant (if any), the registered health practitioner or student concerned, or any other person entitled to appear to pay costs to another person as decided by the Tribunal. Clause 13(4) states that cl 13 applies instead of s 60 of the NCAT Act, which provides that each party is to pay their own costs unless there are "special circumstances".
3. The Commission submits the general rule is that costs follow the event and that the "mere impecuniosity is not a justifiable reason for departing from that rule": Health Care Complaints Commission v Philipiah [2013] NSWCA 342 at [42]. The presumption that a successful party is awarded their costs is generally only displaced where there is some disentitling conduct by the successful party: Oshlack v Richmond River Council [1998] HCA 11. We note that this submission is also consistent with Qasim v Health Care Complaints Commission [2015] NSWCA 282 at [85], Health Care Complaints Commission v Do [2014] NSWCA 307 at [51] and the Tribunal's Occupational Division Guideline, Costs (August 2017) which states at cl 14:

"The Tribunal may make a costs order in disciplinary proceedings or an appeal brought under the Health Practitioner Regulation National Law. Costs are generally awarded to the successful party unless there are disqualifying circumstances."

1. The practitioner submits that she is on a pension and cannot afford to pay costs. Her breaches of confidentiality and privacy were wrongful, but she did not intend to harm anyone, she wanted and voluntarily agreed not to re-register and has cooperated with the Commission. We note that the practitioner actively participated in the hearing, although we accept that she has not filed material in compliance with the Tribunal directions. She seeks an order that each party pay their own costs, but she does not point to any disentitling conduct by the Commission.
2. The general principles in relation to costs in matters under the National Law (NSW) have been summarised in the decision of Deputy President, Seiden SC, DCJ, in Puri v Medical Council of New South Wales (No 2) [2024] NSWCATOD 122.
3. As observed by Deputy President Seiden SC DCJ at [13] and [14], principles relevant to the general rule are that costs generally follow the event, although this is not an absolute rule. Costs compensate the winning party and are not a form of punishment, but this rule may be displaced if the winning party engages in conduct that disentitles them to costs. The onus is on the losing party to establish a basis for any departure from the usual rule: Health Care Complaints Commission v Balafas (No 2) [2021] NSWCATOD 175. Costs may be apportioned or reduced, or various orders may be made that reflect the circumstances and are consistent with the underlying decision. Costs are in the Tribunal's discretion which should be exercised judicially: Cole DCJ in Health Care Complaints Commission v Wilcox (No 2) [2020] NSWCATOD 51 at [11].
4. In our view, the Commission is entitled to its costs on an ordinary basis. The Commission succeeded on all claims made and did not delay or prolong the proceedings. There is no evidence of disentitling conduct which would disturb the usual rule, and the Commission questioned the practitioner, appropriately in our view, to give her the opportunity to explain her conduct and to make submissions about the orders that should be made.
5. Accordingly, we order that the practitioner pay the costs of the proceedings, as agreed or as assessed.

(1) The particulars of Complaint One are established.

(2) The respondent is guilty of unsatisfactory professional conduct under s139B(1)(l) of the Health Practitioner Regulation National Law (NSW).

(3) The Particulars of Complaint Two are established.

(4) The respondent is guilty of professional misconduct s 139E of the Health Practitioner Regulation National Law (NSW).

1. Accordingly, the Tribunal makes the following orders:

(1) Under s 149C(4)(a) of the Health Practitioner Regulation National Law (NSW) the Tribunal orders that if the respondent were still registered the Tribunal would have cancelled her registration pursuant to s 149C(1)(b).

(2) Under s 149C(4)(b) of the Health Practitioner Regulation National Law (NSW), the Tribunal orders that the practitioner is disqualified from being registered for a period of 12 months.

(3) Under s 149C(4)(c) of the Health Practitioner Regulation National Law (NSW), the Tribunal orders that the National Board is required to record the fact that if the respondent were still registered, the Tribunal would have cancelled the respondent's registration in the National Register kept by the Board.

(4) Under s 149C(7) of the Health Practitioner Regulation National Law (NSW), the Tribunal orders that an application for review of order (1) may not be made until 12 months for the date of this order.

(5) An order that the respondent pay the applicant's costs under clause 13 of Schedule 5D of the Health Practitioner Regulation National Law (NSW) as agreed or assessed.

(6) A direction is made that the name and addresses of the witnesses listed in the Schedule to the Complaint attached to the Amended Application for disciplinary findings and orders not be disclosed under cl 7 of Schedule 5D of the Health Practitioner Regulation National Law (NSW).

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.