NHS Tayside apologises to patients after Ninewells scientist's data breach

A Scottish employment tribunal has dismissed the claim of a former clinical scientist sacked by NHS Tayside for serious misconduct. The ruling found that, while on restricted duties, he looked at patients' medical records without authorisation. BBC News reports that NHS Tayside has apologised to patients.

What was found

The hearing took place in Dundee on 3, 4 and 6 August 2026. The judgment was sent to the parties on 16 September 2026. Employment Judge P Rae found that the man was not unfairly dismissed, so the claim was dismissed.

The employee had worked for NHS Tayside as a clinical scientist since 1 December 2009. He was dismissed on 16 June 2025 for gross misconduct. His main place of work was Ninewells Hospital in Dundee.

According to the tribunal's findings, while on restricted duties in place of suspension, the scientist opened the records of 386 patients, 497 times in total. It was found that he had neither authority nor a legitimate reason to do so. The description of the case refers to "almost 400" patients, while the judgment itself gives 386 people.

Reporting and the health board's response

The matter was reported to the Information Commissioner's Office (ICO). The ICO recommended informing the police and telling patients that their records appeared to have been accessed without authorisation. The affected patients were notified of the incident.

The man admitted opening the records but said he had legitimate reasons, including clinical audits. His employer found these explanations unsatisfactory.

The tribunal's reasoning

The tribunal stressed that it was not deciding guilt or innocence over the alleged misconduct and was not re-hearing the disciplinary case. It examined whether the employer acted reasonably. It found the investigation appropriate and that the employer genuinely believed misconduct had occurred. It noted that the matter was serious and that the employer saw a lack of insight and a risk of repetition.

The tribunal also did not allow an application, made on 20 July 2026, about two weeks before the hearing, to extend the claim with a whistleblowing complaint.

What this means for you

NHS patients can expect access to their records to be limited to people who need it for their work. The case shows that when records are accessed without authorisation, the organisation must report it to the ICO, and patients are informed. People who have received such a letter from NHS Tayside can contact the board for details.