Boredom and immaturity said to be main drivers behind the administrative assistant accessing mental health and medical records.
20-year-old Demi Lou Stevens pled guilty to 16 offences of unauthorised access to computer material, when she appeared in the Summary Court on April 12.
On May 22 she was sentenced to 8 months in custody, suspended for 18 months, by Senior Magistrate Malcolm Simmons.
Crown Prosecutor Stuart Walker said Ms Stevens accessed 289 patient records when she was working as an administrative assistant for the Community Support Team (CST) between June and October 2022.
She was authorised to access records of patients under care of the CST in relation to her duties, which included scanning in documents and providing nurses and carers with relevant information if they were out of the office.
Mr Walker said the defendant had been given training on accessing records, had sworn an oath of secrecy, and had signed a code of confidentiality which stated staff must not access medical records for their own interests.
As part of her role, she was given a login for the electronic patient record system called EMIS. The login gave her access not only to patient’s records under care of the CST, but to all hospital patient records including those receiving care from the Emotional Wellbeing Service.
Mr Walker said everything was “wide open” to her and it was taken on trust she would act in accordance with the confidentiality code she had signed.
“A callous disrespect for patients”
The full extent of Ms Stevens’ actions came to light when the Department of Health and Social Services (DHSS) opened an investigation after being prompted by a patient.
The patient, Mr Walker explained, asked the hospital for an audit of who had accessed their records in October last year.
The audit trail showed the defendant had accessed data of a patient not under care of the CST.
When questioned, Ms Stevens originally denied accessing these files but later called her line manager to admit her wrongdoing. She was suspended from her employment.
An audit of all 3,705 patient records was undertaken which showed Ms Stevens had accessed 289 records.
Affected patients were notified by letter and the Royal Falkland Islands Police opened an investigation after 16 formal complaints were made.
Ms Stevens was arrested by the police and admitted to accessing the 16 records out of boredom, prompted by seeing patient names on the daily appointments. She said she did not share the information.
Documents she accessed included consultation histories, referral documents, mental health records, and antenatal appointments.
Mr Walker said she “systematically plundered private information for her own interest” and showed a “callous disrespect for patients.”
Loss of trust in the medical department
Victims’ statements read out in court described patients feeling sick, shocked, and suffering from sleepless nights. Some patients described stopping their appointments altogether.
Mr Walker said 388 requests for medical record audits were made after people became aware of the breach, which caused a burden on staff.
He said: “The police had to provide support due to the loss of trust in the medical department.
“The victims were vulnerable, the harm caused is significant and caused detrimental impact on the wider public interest.”
The hospital’s professionalism questioned
One victim’s statement, read out in court, detailed a previous court case involving their entire family’s medical records being read by a hospital employee who had no authorisation to do so:
“This is the second impact statement I have had to write in relation to employees at the King Edward VII Memorial Hospital illegally accessing the confidential medical records of our family.
“We so distrust the hospital’s senior management we ask for repeat audits of our records every few months… had we not made this request, this employee would still be reading people’s records for fun.”
A guarded approach to seeking help for mental health and medical problems was described by the victim as a direct result of this latest data breach.
“I say this knowing it may have a negative impact on my health.
“The medical department failed to discover either of these individuals and I do not believe the Caldicott Guardian, and others, are doing their jobs effectively.”
Boredom led to records being read
Ms Stevens’ lawyer Shantel Hazelman asked the court to be mindful of her client’s immaturity at the time of the offences.
Describing when Ms Stevens began work for the CST, the lawyer said: “She was based at Lookout Estate and left to work alone, declining an offer to move.”
It was said the defendant didn’t have much to do and was bored.
“She was 19 at the time and knew it was wrong. She lacked maturity.”
Ms Hazelman acknowledged the impact on the community from Ms Stevens’ actions and submitted the community had an impact on her client. She asked the court to consider the defendant’s police interview where she expressed a fear of being attacked at her house and receiving messages which she couldn’t respond to.
“I ask the court to consider what she had to go through, and being pregnant at the time. She had no motivation and no personal gain. There was no damage to software, or financial loss,” said Ms Hazelman.
When considering sentence, Mr Simmons told the defendant the offences she was convicted of were very serious.
He said he was “troubled and surprised” Ms Stevens had access to all medical records with such ease.
Mr Simmons continued: “Children were involved. Patients suffered sleepless nights and panic attacks, shattered trust, setbacks in treatment, and time was taken off work, affecting income.”
Mr Simmons sentenced Ms Stevens to 12 months custody on each count, concurrent. Full credit was given for her early guilty pleas and the sentence was reduced by a third, to 8 months.
The senior magistrate said he considered the impact on Ms Stevens’ infant child if she were to go immediately into custody, which he said would be severe. Therefore, he decided to suspend the sentence for 18 months.
Mr Simmons did not make any compensation orders and said claims are more appropriately dealt with in the civil courts.
Ms Stevens was also ordered to pay one hundred and fifty pounds in court costs.
