Doctors and nurses charged in mass patient data breach cite accidental clicks and lack of awareness

Around 50 doctors and nurses in northern Finland are facing charges for allegedly accessing patient records without authorisation, with most denying wrongdoing, Yle reports.

The case centres on staff at the Pohde wellbeing services county who are accused of viewing confidential data related to a botched surgery in 2023. The patient involved was also a Pohde employee.

Prosecutors claim the majority accessed information through the Lesu surgical management system without permission. Defendants have offered varying explanations, including accidental clicks, unawareness that the data was restricted, or claims that the records did not constitute formal patient information. Some in supervisory roles argue they reviewed the data for training or oversight purposes, while others state their login credentials were used by unauthorised persons on unlocked computers.

Prosecutor Emilia Mourujärvi has called for convictions on data protection violations, with additional charges of negligent misconduct in office for those in managerial positions. “These are healthcare professionals whose training in data protection begins in higher education and continues in their daily work,” she stated.

The trial is set to begin in Oulu District Court this autumn, where defendants will testify in person. The alleged victim is also seeking damages, citing a deputy data protection ombudsman’s opinion that there was no legitimate basis for accessing the records.