Landspítali employee reprimanded for unauthorised access to patient records

Iceland’s Data Protection Authority has reprimanded a Landspítali hospital employee for accessing a patient’s medical records without lawful grounds, mbl.is reports.

The authority said the employee’s handling of the patient’s personal information did not comply with data protection law. Its decision was issued on October 5.

The patient complained on May 12, 2025, about nine occasions when the employee accessed her records between December 2021 and July 2024. The hospital’s electronic medical records oversight committee found that the employee had not shown she had a legitimate reason to access the records.

The Data Protection Authority examined whether the access was necessary for a clearly specified purpose. It concluded that the employee had exceeded her access permissions and was responsible for the processing of the patient’s personal information. The authority issued her a reprimand for violating data protection law.