The Department of Health (DH) and the Hospital Authority (HA) announced today that a doctor deployed from the HA to the DH for specialty training was suspected of accessing medical records of patients without authorisation while conducting clinical research. The patients were not under the doctor's direct care.

The DH previously received an enquiry from a member of the public regarding access to electronic health records and launched an investigation.

The DH found that in March this year, a doctor undergoing specialty training accessed the medical records of patients not under the doctor's direct care without authorisation through the clinical information management system of the Social Hygiene Clinics and eHealth system, involving a total of 47 patients.

The doctor in question has been deployed to the DH's Social Hygiene Service since 2023, where the doctor undergoes regular training on a weekly basis, participates in clinical service and provides medical consultations to patients.

According to individual specialty college requirements, doctors under specialty training are required to participate in research projects as part of their specialty training.

It is understood that the doctor in question was conducting a clinical research project that had been approved by the HA's Institutional Review Board.

The scope of the approval was limited to patients' records from public hospitals and did not cover the DH's patient records. The doctor accessed the relevant records without obtaining separate authorisation from the DH.

In response to the incident, the DH has immediately suspended the doctor's training and referred to Police for follow up. The DH has also reported the case to the Office of the Privacy Commissioner for Personal Data, the Commissioner for Electronic Health Record and the HA, which employed the doctor. The DH is currently notifying the affected individuals.

The HA earlier received the DH's notification and learned that the DH had reported the incident to law enforcement and regulatory authorities. The HA will fully co-operate with the investigation.

The HA said it believes that although this is an isolated incident related to clinical research, the procedure was inappropriate, noting that it will take this matter seriously and strengthen staff training on the precautions they should take when using patient data for clinical research.

Both the DH and the HA reiterated that they attach great importance to protecting patient privacy, adding that there are established mechanisms to regulate staff conduct and discipline.