NHS Tayside doctor sacked after accessing records of patients for 'breastfeeding audit'

An NHS Tayside doctor was sacked by the health board after accessing the records of patients for a “breastfeeding audit” in a massive data breach involving hundreds of records.

Dr Glen Gardner was dismissed after looking at the records of 386 patients without authorisation while temporarily reassigned away from his role at the nuclear medicine department at Ninewells Hospital to non-clinical duties.

The scientist was under investigation at the hospital over concerns raised in August 2023 “erroneous” advice he had given to a patient regarding her breastfeeding while undergoing treatment.

The health board did not restrict Dr Gardner’s access to the patient record CRIS system while he was moved to other duties.

The data breaches, which occurred between August 16 and November 3 2023 and then again between April 16 and May 6 2024, were made public in the findings of an employment tribunal after the scientist claimed unfair dismissal over the incidents.

The scientist was absent through sickness between November 3 2023 and April 16 2024.

The tribunal found in favour of NHS Tayside.

‘An audit of breastfeeding patients’

An investigation was launched at the health board after an employee from nuclear medicine noticed that Dr Gardner was accessing records while assigned to other project duties.

The scientist argued that his removal from the department was a “change of location” and said he was never informed that he should not be accessing patient data.

His explanation for looking at the records included that he was undertaking a PET (Positron Emission Tomography) audit and performing an audit of breastfeeding patients.

However, when questioned by the health board, Dr Gardner told investigators he had not “recorded the audit as yet”.

He said he would do so after his “clinical systems had been reinstated” following his return to the the nuclear medicine department.

The health board’s investigator believed Dr Gardner had not provided a satisfactory explanation or evidenced legitimate reasons as to why the data had been accessed.

‘I have been suspended from my duties’

On a meeting on July 30 2024, Dr Gardner disputed that his position had been changed, telling the investigator “no discussions were held that my role was changed, just my location”.

However, in a separate grievance, the scientist wrote: “I have been suspended from my duties in nuclear medicine”.

He went on to complain the “removal of my duties and responsibilities in nuclear medicine, I was relocated to another area of the hospital and given menial – for me – imaging processing task.”

In the final report, it was concluded by the investigator that “evidence supports the finding that [Dr Gardner’s] methods and clinical working practices include inappropriate means of accessing data including inappropriate access of patient records”.

Dr Gardner was sacked for gross misconduct on June 16 2025 with NHS Tayside believing there had been 497 data breach incidents.

In his appeal, the scientist was critical of the the fact the health board did not remove his systems access when he was assigned to alternative duties.

He argued this would have prevented him from looking at patient data.

It was also admitted by health board staff that the scientist had never been told his temporary responsibilities in writing.

The tribunal chair found Dr Gardner to be “honest and credible” in his evidence but “somewhat guarded” under cross-examination before upholding the decision to dismiss the scientist.

‘Information was viewed inappropriately’

The revelation of the data breach comes just months after NHS Tayside launched an investigation into claims staff snooped on the medical records of schoolgirl Minnie Merriman who was allegedly murdered in Arbroath in August.

In September, the health board admitted it does not have enough staff to check how many data breaches involving patient records there has been.

More than 800 breaches were reported in 2025-26, with 446 confirmed.

Concerning the case of Dr Gardner, a spokesperson for NHS Tayside said: “Following a comprehensive investigation under NHS Scotland workforce policy, it was identified that personal information was viewed inappropriately by a single member of staff.

“This staff member was dismissed in June 2025.

“In its judgment, an Employment Tribunal backed this course of disciplinary action, stating the claimant’s actions were sufficient reason for dismissal.”

NHS Tayside said it reported the incident to the Scottish Information Commissioner who found that there was no evidence that the personal data left NHS Tayside’s systems.

“Patients who have been affected are being contacted directly to explain what happened to their information in detail and to offer a sincere apology,” said the health board spokesperson.