Complainant

Respondent

Anonymised Parties

A nurse

A hospital

Representatives

Lorraine Monaghan, Irish Nurses and Midwives Organisation

Aisling McDevitt, IBEC

Act

Complaint/Dispute Reference No.

Date of Receipt

Complaint seeking adjudication by the Workplace Relations Commission under Section 8 of the Unfair Dismissals Act, 1977

CA-00010948-001

25/04/2017

The complainant is a qualified nurse and midwife. In February 2010, she commenced employment with the respondent in a non-nursing role, in the hospital’s Clinical Risk and Claims Department. In addition to this job, from November 2012, she worked extra shifts as an assisting nurse in a special area of the hospital, referred to in this decision as the “the clinic.” In January 2015, she started a Higher Diploma in Nursing, accredited by the Royal College of Surgeons in Ireland (RCSI). The complainant was sponsored by the hospital to take the course, receiving her salary while studying during the calendar year of 2015.   While she was on the course, she continued to do shifts in the clinic up to June 2015.

On October 12th 2015, a fellow-student on the diploma programme found a journal with a record of 67 clinic cases in the hospital students’ room. The journal had been left there by the complainant on October 9th. The journal was labelled “Logbook 7” and was a personal record compiled by the complainant of cases that she had assisted on since 2012. The respondent argues that the logbook contained information that could have led to the identification of patients and their treatment.

The complainant was suspended in November 2015 and prevented from completing the diploma course.   Following a long period of suspension during which a disciplinary investigation was carried out, the complainant was dismissed on November 28th 2016. She appealed against the termination of her employment and following a hearing on December 13th 2016, the decision to dismiss her was upheld.

Submitting that her dismissal is unfair, the complainant is seeking reinstatement to her job in the hospital and the opportunity to finish the Higher Diploma in Nursing.   Although she was permitted to complete the theory part, three weeks of the clinical component of the course remained when she was suspended in November 2015 and she cannot obtain the diploma unless she completes the course in full.

Investigation into the Recording of Cases in a Logbook

Following the handing in of the logbook to a manager on October 12th 2015, the complainant was suspended in accordance with the hospital’s disciplinary procedure.   Under the heading of “serious misconduct,” the procedure provides for an investigation to be carried out to establish the facts in accordance with the principles of fairness and natural justice, including a presumption of innocence. Investigations are to be governed by clear terms of reference.

This serious misconduct section of the disciplinary procedure concludes with a reference to the investigation into the alleged misconduct:

“On completion of the investigation, the investigator(s) will submit a written report of their findings and recommendations to senior management and the employee. If the outcome of the investigation is that there is a reasonable belief that the employee is guilty of the alleged misconduct, a disciplinary hearing may be convened under stage 4 of the disciplinary procedure to determine the appropriate disciplinary sanction.”

An investigation team was established, chaired by a Consultant who had been involved in the establishment of the clinic. She was accompanied on the investigation team by the Deputy HR Manager and another senior manager. All three attended the hearing into this complaint and the Chairperson gave evidence of the meetings conducted with the complainant and other witnesses.   The reason for the investigation was set out on page 1 of the investigation team’s final report:

“The allegations arise as a result of hospital management being presented with a journal identified as Logbook 7.’ This logbook was found in an insecure location within the hospital campus. This logbook contained sensitive personal patient information which (name of the complainant) is alleged to have recorded without authorisation.”

At a meeting on February 5th 2016, the complainant was interviewed by the members of the investigation team. She was accompanied at the interview by Lorraine Monaghan of the INMO. Later in February, the investigation team interviewed the course co-ordinator for the Higher Diploma in Nursing, a clinical nurse specialist and another senior nurse in the clinic. The complainant was invited to review the transcripts of her own interview and those of the three witnesses. On March 16th, she sent clarifications on some of the issues that came up at the meeting she attended and she also responded to the notes of the interviews with the witnesses.

It appears that the investigation team concluded a draft report on March 30th, but this was not provided to the complainant until May 23rd 2016. The INMO made a number of submissions on the draft report and a final version was issued on August 8th 2016.   Finding that the complainant had breached the hospital’s Data Protection Policy, the Data Protection Acts 1998 and 2003, the Code of Conduct and Confidentiality in her contract of employment and the regulations of the Nursing and Midwifery Board of Ireland (NMBI), the investigators determined that the complainant was “guilty of the alleged misconduct” (set out in italics above).

Addressing the specific issue of the compilation and retention of patient records in a logbook, section 11 of the investigation report states:

“As the policies / regulations / Acts / contract of employment were breached by (name of complainant’s) actions, we find that the information was:

a.   Not obtained and processed fairly – 67 patient records

b.   Not relevant to (name of complainant’s) role as a student / employee

c.   Records of information contained in ‘logbook 7’ were excessive

d.   It was not necessary for (name of complainant) to gather the patient information as part of the Higher Diploma in Nursing (name of the specific programme withheld)

e.   The purpose specific - (name of complainant) initially stated that she recorded the information for her to maintain her (non-Irish) registration

f. Not held securely between June and October 2015. ‘Logbook 7’ was transported between (name of complainant’s) home and the (name of hospital). (Name of complainant) confirmed the transportation arrangements for logbook 7.”

In her evidence, the Chairperson of the investigation team said that it was clear that the complainant was very regretful of her actions. This was also evident to me at the hearing. The report acknowledged that the complainant –

“…has apologised for any ‘wrong-doing’ and was sincere and truthful in relation to the allegations. It was however, noted by the investigation team that (the complainant) was not cognisant of and did not demonstrate any insight into the implications of her actions and potential consequences of these actions in relation to the …patient / services users, the upset caused to colleagues / students, or the potentially catastrophic reputational impact on …the hospital.”

Disciplinary Hearing

Between August and November 2016, there was a further delay convening a disciplinary hearing, partly due to the intervention of the complainant’s solicitors who sought to represent her interests in respect of the outcome of the August 8th report. A meeting finally took place on November 21st 2016 and the complainant was again represented by the INMO. The hospital’s HR Manager chaired the meeting and he was accompanied by another senior manager.

At the meeting, the complainant and her representative were asked to respond to the findings of the investigation report. They objected to the fact that the investigation team was made up of three internal managers, they were concerned about the lack of training in data protection, they claimed that the approach to the logbook was inconsistent when compared with a similar data breach and they claimed that the complainant had no malicious intent in compiling the logbook.

A second meeting was convened three days later, November 24th, the purpose of which was to communicate the outcome of the disciplinary hearing. The HR Manger informed the complainant that, in compiling the logbook, her actions amounted to serious misconduct and her employment was being terminated. This was confirmed by letter on November 28th 2016. The complainant appealed this decision to the Secretary Manager of the hospital at a meeting on December 13th, but the decision to dismiss was upheld.

The Reason the Complainant was Dismissed

The complainant was dismissed because, over a period of two to three weeks in the summer of 2015, she compiled a logbook of 67 records of patient cases that she had been involved in since 2012, with details that could have identified the patients and compromised them and the hospital. As a nurse, and then as a manager in the Clinical Risk Department, she understood the requirement for confidentiality and the requirement for the hospital to respect patient data and to keep it safe. Logbook 7 was not kept in a safe place, but was inadvertently left in a study room of the hospital and found by another student. In compiling this logbook for her personal use, and by removing the information from the hospital, the complainant was found to have breached the hospital’s data protection policy, the Data Protection Acts, the confidentiality requirements of her contract and the regulations of the NMBI.

Disciplinary Procedure

For the respondent, Ms McDevitt submitted that the procedure that resulted in the dismissal of the complainant was procedurally fair. The complainant was aware of the allegations against her in respect of the retention of patient data, she was provided with an opportunity to respond to the allegations and the matter was investigated in full before the decision to dismiss her was made. The complainant was represented at all times and the hospital considered her explanation of her actions. Finally, the complainant availed of her right to appeal against the hospital’s decision.

Case Law Referenced by the Respondent

In the case of Walls Leisure Ltd v Said Belarbi, UD 492/2008, the EAT found that there were deficiencies in the company’s disciplinary procedure; however, weighing the substantive reason for the dismissal against the procedural defects, it found that the dismissal of Mr Belarbi was not unfair.

Debbie Forder v AV Pound & Company Limited, UD 927/2011, was cited by Ms McDevitt as an example of a similar case involving a breach of data protection, where the EAT found against the claimant. She also referred to the 2016 Circuit Criminal Court case of Enda Farrell and NAMA, where Mr Farrell admitted sending confidential information about property valuations to investment companies.

A Canadian precedent involving the Centre Hospitalier de L’Université de Montréal and the Association des Medicins Résidents de Montréal was cited as a case which resulted in the dismissal of an emergency room employee who disclosed information to a colleague about a patient to whom he was related.

Why did the Complainant Compile the Logbook?

In her evidence at the hearing, the complainant said that on Tuesday, October 13th2015, she got a text message from a student on the diploma course, letting her know that she found the complainant’s journal in the students’ room.   That evening at home, the complainant said that she couldn’t find her “logbook 7,” and she realised that this must have been what the student found. The logbook was among a number of other documents left in a folder on a desk in the students’ room, including her journal from the Higher Diploma in Nursing.

In evidence, the complainant said that she compiled the log over a period of two to three weeks in the summer of 2015, working in the kitchen area of the clinic. The information was taken from the current register and some of the previous registers. It contained details of 67 cases that the complainant had been involved in as an assisting nurse since she joined the clinic in 2012.

At the meeting with the investigation team on February 5th 2016, the complainant was asked why she compiled the log. She said that she was re-registering as a midwife in two jurisdictions where she had worked in the past and she had to prove that she had completed 450 clinical hours. As her job in the Clinical Risk Department meant that she had not worked in a clinical role for five years, she was submitting that her time as an assistant nurse would be evidence that she had kept up her clinical work. When she was challenged about this, on the basis that the foreign nursing boards were unlikely to look for details of the patients who were the subjects of the clinical hours, the complainant said that it was “something I did, compiling a log of cases I had a personal interest, that was all it was for, it was nobody else’s information, it was something that I had done as a qualified midwife as well.”   She went on to say that she compiled the journal for “reflective purposes,” to reflect on things she had learned.

At the hearing, when her representative asked her why she included so much detail in the logbook, the complainant said that she used to do the same as a midwife. She compiled a log of the patient cases that she had worked on, for reflective purposes, to record what she had learned. She said that, in previous roles, she had been commended for the quality of her records. Her other logbooks were numbered 1 – 6 and this was the seventh. At the hearing, she said that she shredded the earlier books.   She said that she did not show logbook 7 to any third party.

During her evidence, the complainant said that she was never instructed that she was not to copy cases from the registers.   She said that the current register is kept on an open shelf in the clinical manager’s office, and that many people have access to this office including doctors, students, assisting nurses and household staff.

She also said that the last time she received any training in data protection was when she joined the hospital in 2010.   She said that there is no specific data protection policy for the clinic.

The complainant was asked about the Higher Diploma in Nursing course and the log that is required as part of that course.   She said that this is a record of three or more observed cases and it contains details similar to the information recorded in her logbook. She said that the records were signed off by the course co-ordinator when they were completed. She said that she brought the diploma journal with her everywhere because she had to get it signed off. When questioned, she agreed that it would have been possible for this journal to have been lost or stolen.

The point being made here by the complainant and her representative is that no issue has arisen from the requirement of students of the Higher Diploma in Nursing to compile a log of three or more cases, and to transport this logbook between the college, the hospital and the students’ homes, with the risk that it could be lost or stolen.

The Complainant’s Response to the Findings of the Investigation Report

From the start of this process, the INMO argued that the decision to suspend the complainant was unnecessary. Secondly, the fact that the complainant was prevented from completing the Higher Diploma in Nursing compounded the harsh treatment of her by the hospital.   Finally, it is the view of the INMO that the dismissal of the complainant was entirely disproportionate in circumstances where she was direct and honest in her responses and sincerely regretful about her actions.

The position of the union is clearly set out in the minutes of the disciplinary hearing on November 21st 2016 as follows:

1. The INMO requested that an independent chairperson be appointed to the investigation team, but this was refused;

2. The team reached their conclusions before the report was finalised;

3. The complainant and her representative were denied access to logbook 7 at the investigation meeting;

4. The student who handed in the logbook was not interviewed as part of the investigation;

5. The investigation took nine months to complete, exacerbating the stress and reputational damage of the complainant;

6. Point 4 of the Terms of Reference states that “the investigation team will be provided with a copy of the document prepared by (the Director of Nursing) which sets out the allegations and any follow-up communication between the parties.” The INMO did not receive a copy of this document.

7. The draft report was provided to the Director of Nursing before it was seen by the complainant and her representative;

8. The INMO’s submissions on the draft report were disregarded;

9. The findings of the final report were unreasonable;

10. There is no specific data protection policy in the CLINIC;

11. The complainant’s contract of employment makes no specific reference to data protection;

12. The complainant did not have a job description;

13. The information in “logbook 7” was gleaned from registers which were not stored in a locked cabinet;

14. The complainant was not told that she could not keep a logbook of patient cases;

15. Medical records were not accessed and the information was not used for personal reasons or with any malicious intention;

16. The logbook was not discovered in a public place, but in a place reserved for hospital staff and students;

17. The complainant did not believe that she was doing anything wrong when she compiled the records; she compiled them for self-reflection;

18. The only training on data protection received by the complainant was at induction in 2010.

The INMO referred to data related to patient deaths found on a photocopier by the complainant in the same location where the logbook was found. In her evidence, the complainant said that she retrieved the photocopies and put them in an envelope and left it on the desk of a senior manager. The INMO questioned if any disciplinary action had been taken in respect of this breach of data protection and they challenged the consistency of the approach being adopted.

The Hospital’s Response to the INMO Submission

In her response to a question from the INMO with regard to their request for an independent person to chair the investigation team, the Director of Nursing said that in her view, the sensitive nature of the matter under investigation made it inappropriate to involve an outsider. When the HR Manager was asked if he had ever agreed to an independent person being involved in a disciplinary hearing, he said that he had done so in the past.

The INMO complained that the logbook was not available at the investigation meeting. In evidence, the Chairperson of the investigation team said that the logbook was available in the office of the Director of Nursing and could be viewed there by the complainant and her representative.   Due to the confidential nature of the contents, the investigation team members also looked at the logbook under supervision in that office and it was not brought to the investigation meeting.

The INMO objected to the fact that the student who found the logbook in the students’ room was not interviewed as part of the investigation. In response, the Chairperson said that the student was excluded because the investigation team decided that it was unnecessary for her to become aware that there was an investigation under way.

The entire process from the date that the complainant was suspended until she was dismissed took over 12 months and, in the view of the INMO, this compounded the cruelty of the hospital’s treatment of the complainant. The hospital representatives said that it was sometimes difficult to arrange meetings due to the unavailability of key people and that the involvement of the complainant’s solicitors also contributed to the delay.

On behalf of the complainant, Ms Monaghan referred to the Terms of Reference for the investigation where it states that “the investigation team will be provided with a copy of the document prepared by (the Director of Nursing) which sets out the allegations and any follow-up communication between the parties.” This document was not provided to the INMO and they questioned its whereabouts. From the evidence of the respondents, it appears that the only document provided to the investigation team before the commencement of the investigation, was the Terms of Reference.

Another issue raised by the union was the fact that the draft report was sent to the Director of Nursing before it was provided to the complainant. In her evidence, the Director of Nursing said that, as the person who commissioned the report, she received it first and then sent it on to the complainant. She said she sent the draft report to the complainant without reading it.

In response to the union’s concern that there is no specific data protection policy in the clinic, the hospital’s representatives said that the clinic was covered by the hospital’s data protection policy.

Ms Monaghan referred to the complainant’s contract of employment and the fact that there is no reference to a data protection policy in the contract. In response, the hospital pointed to page 4 of the contract where it states that:

“All employees are expected to be aware of and adhere to all Hospital policies and procedures.”

There was a long and protracted discussion at the first day of the hearing about the location of the register that the complainant accessed for the records she transcribed into her logbook. The union argued that the register was not stored in a manner appropriate to a record containing sensitive patient data. For the hospital, the witnesses said that there is a current register, which holds information about patients on a calendar basis as they are attended to in the clinic. As the register fills up, a new one is opened. Previous registers are stored in a locked office with individual patient charts but the current “in use” register is kept on a shelf in the clinical manager’s room. This room is locked and keys are available to a number of people, including the students on the diploma course. Before coming up to this door, the clinic itself is accessed using a key coded lock.

On behalf of the complainant, the union argued that the students’ room where the logbook was found, is not a public place, and the risk of it coming into the possession of a member of the public was low. The hospital argued that the students’ room could have been accessed by patients and their partners on ante-natal visits or by students of nursing or transition year students. They also argued that any member of staff who found the logbook could have read the records and could possibly have identified someone they knew.

The union argued that the hospital was in breach of its own policies when it came to training on data protection, and specifically, section 8 where it states:

“All staff involved in data processing must receive training on the data protection principles and their obligations under the Acts.   Training is provided by staff in the Information Management Department at regular intervals or specific departmental training will be provided on request.”

They further submitted that if the complainant had received more regular training, she might not have compiled the logbook in the first instance.

In response, the hospital representatives pointed out that the complainant’s job in the Clinical Risk Department involved her in the management of sensitive patient data.   In her role, they said that she must have been aware of her responsibility for the confidentiality and safety of patient information. The Chairperson of the investigation team pointed out that, at the commencement of the Higher Diploma programme, the complainant received training about the absolute requirement for confidentiality of patient information in the clinic.

Case Law Referenced by the Complainant

Following the announcement by the hospital that there would be an investigation into the conduct of the complainant, the INMO sought to have an independent person on the investigation team, and they suggested a specific person who could fill that role. The hospital would not agree to this request and, on this basis, the case of Conway v HSE [2016] IEHC 73 was cited as a case which establishes the right of an employee who is subject to a disciplinary process, to have some input into the membership of the investigation panel.

The case of Bentley v Tesco Ireland Ltd, 818/2012 was cited on the basis of the Tribunal’s statement about the requirement for “vigilance, care and fairness” in the disciplinary process.

The comments of Flood J in Frizelle v New Ross Credit Union Ltd [1997] IEHC 137 were referenced to demonstrate that where a dismissal is contemplated, “there are certain premises which must be established to support the decision to terminate employment for misconduct.”

The Governor of the Bank of Ireland v Reilly [2014] IEHC 241 was cited as a case where the actions of the complainant, although wrong, caused no damage to the bank. In this case, Noonan J founds that the “only appropriate remedy is reinstatement.”

The relevance of these precedents will be addressed in the next section.

Statutory Provisions

Section 6(1) of the Unfair Dismissals Act 1977 provides that:

“Subject to the provisions of this section, the dismissal of an employee shall be deemed, for the purposes of this Act, to be an unfair dismissal, unless, having regard to all the circumstances, there were substantial grounds justifying the dismissal.”

The burden of proof rests with the respondent to establish the substantial grounds justifying the dismissal of the complainant in this case. The respondent referred to Section 6(4)(b) of the 1977 Act which provides that;

“…the dismissal of an employee shall be deemed, for the purposes of this Act not to be an unfair dismissal if it results wholly or mainly from …the conduct of the employee.”

The conduct which led to the complainant’s dismissal is the fact that she compiled, for her personal benefit, a record of 67 patient cases, using data from the clinic registers from 2012. She said that she did this to have a record of her clinical hours so that she could re-register as a nurse outside Ireland and for “reflective purposes,” to see what she had learned.

It is not my role to adjudicate on the credibility or otherwise of this explanation or, as set out in Looney & Co. Ltd v Looney, UD 843, 1984, which was referenced by the INMO, “to seek to establish the guilt or innocence of the claimant.” Having considered the evidence of the parties, my task is to consider if the decision to dismiss the complainant was reasonable and, in reaching this decision, was the process which resulted in the dismissal a fair process?

Was the Decision to Dismiss Reasonable?

In the case under consideration, there is no dispute about the conduct which resulted in the dismissal.   The complainant agreed that the journal contained a log of 67 cases, she did not dispute the extent of the information that she transcribed from the registers and she conceded that the information was excessive.

Submitting that her dismissal is unfair, the INMO referred to the High Court appeal of James Reilly against the Governor of the Bank of Ireland [2014] IEHC 241. In this case, Mr Justice Noonan found that the decision to dismiss Mr Reilly for sending and receiving inappropriate e mails from his work computer was not reasonable. Over a two-year period, 29 offending e mails were identified by Mr Reilly’s manager, some of which he sent and others which he received.   Having examined this case, I do not think the conduct of Mr Reilly is comparable to that of the complainant for the following reasons:

The inappropriate e mails found on Mr Reilly’s computer were not business-related and were not about any of the bank’s customers.

Unlike the data recorded in “logbook 7,” they did not contain sensitive personal information.   Even if every customer of the bank had found out about them, they were not personally affected and they could not claim that there had been a breach of data protection.

If it had become public, Mr Reilly’s conduct may have caused reputational damage to his employer, but it does not go to the root of the relationship between the customers and the bank. The patients of the hospital have a legitimate right to expect that the information that the hospital holds about them is held securely and is used only for the purpose that they expect it to be used.

If it had become known that the complainant was keeping a logbook of patient cases, the reputation of the hospital would have been undermined to an enormous extent. The confidence that patients expect to have in the clinic would have been destroyed and the patients whose information was contained in the logbook could have initiated legal actions against the hospital and against the complainant.

The complainant said that she compiled the logbook to re-register as a nurse in the jurisdictions where she had trained and worked in the past, and for reflective purposes.   In so doing, she copied patient information for her personal use. The logbook was found in the students’ room of the hospital; however, there is no evidence that it was accessed by anyone other than the student who found it.

Having considered this matter, I have to concur with the respondent’s position that if the logbook had been found by a member of the cleaning staff, for example, or a member of the public, the consequences for the hospital would have been extremely serious. My concern however, is not with “what if?” but with the facts. The critical fact in my view, is that the complainant compiled the logbook for her personal use.

The investigation report concluded that the complainant’s actions breached the Data Protection Acts, the hospital’s data protection policy, the complainant’s contract of employment and the NMBI Code of Professional Conduct. I will consider the implications of each of these breaches separately.

The Data Protection Act 1988 and 2003

Data is property and the law recognises this by placing obligations on organisations who take information from clients and the public for the purpose of selling or providing goods or services. The data in logbook 7 was the property of the “data subjects,” the 67 patients.   The hospital is the controller of patient data. In summary, the data controller must ensure that data in their possession is processed fairly, is accurate, complete and up to date. Section 2(1) of the Data Protection Act 1988 (amended) expands on these responsibilities:

“(c)   the data –

(i)   shall have been obtained only for one or more specified, explicit and legitimate purposes,

(ii)   shall not be further processed in a manner incompatible with that purpose or those purposes,

(iii)   shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they were collected or are further processed, and

(iv) shall not be kept for longer than is necessary for that purpose or those purposes.”

The data in logbook 7 was transcribed there for a purpose that was not specified, explicit or legitimate, a clear breach of sub-section (i). It was also processed further in a manner incompatible with the purpose for which it was intended, a breach of sub-section (ii). It is clear from this section of the Acts that responsibility for ensuring that data is processed in the manner for which it is intended rests with the data controller, in this case, the hospital.   I find therefore that the conclusion of the investigation team that the complainant breached the Data Protection Acts is incorrect and responsibility for this breach lies with the hospital.

The INMO submission draws specific attention to sub-section (d) of Section 2(1) of the Acts:

“Appropriate security measures shall be taken against unauthorised access to, or unauthorised alteration, disclosure or destruction of, the data, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.”

This is a reference to the fact that the current register containing some of the information that the complainant transcribed was accessible on a shelf in the office of the Clinical Nurse Manager. In my view, this citation does not support the complainant’s case, as she was authorised to have access to the registers, and there is no evidence that she altered, disclosed or destroyed the information contained in them.

The Acts recognise two categories of data, “personal data” and “sensitive personal data.” In the case under consideration, we are concerned with sensitive personal data which, in Section 1 of the amended Act, is defined as:

“… data as to

(a) the racial or ethnic origin, the political opinions or the religious or philosophical beliefs of the data subject,

(b)   whether the data subject is a member of a trade union,

(c)   the physical or mental health or condition or sexual life of the data subject,

(d)   the commission or alleged commission of any alleged offence by the data subject, or,

(e) any proceedings for an offence committed or alleged to have been committed by the data subject, the disposal of such proceedings or the sentence of any court in such proceedings.”

The relevant category is (c). For many of us who engage with client information, personal data is simply evidence of identity and a record of events and we can lose our sense of the importance of the data to the “data subject.” Data is simply what we need to do our jobs. In the medical profession, however, and in particular, in the role held by the complainant, information is extremely sensitive and compromising and the requirement for confidentiality is much higher than that which applies, for example, in financial services. It is my view that the complainant must have, or, should have known this. The compiling of the logbook is completely at odds with the standard of patient confidentiality required of her role, and it is my view that it could not have been regarded by her employer as anything other than extremely serious misconduct.

Data Protection Policy

By putting in place a data protection policy, the Data Protection Acts are brought to bear on the hospital’s staff. Section 1 of the policy states:

“it is the aim of this policy to ensure that all our obligations are clearly stated and that all staff are aware of their responsibilities under the Data Protection Acts.

There are eight principles of the Data Protection Acts (1988 & 2003) which state that information should be:

§   Obtained and processed fairly; which means that the person providing it must know the purposes for which it will be used and the persons to whom it will be disclosed;

§   Relevant and not excessive; we do not obtain information that has no bearing on the welfare of the patient under our care or on the welfare of our staff whilst in our employment;

§   Accurate, complete, up to date and well-organised;

§   Held no longer than is necessary;

§   Devoid of prejudicial, derogatory, malicious, vexatious or irrelevant statements about the individual;

§   Purpose specific;

§   Held securely; and

§   Accessible to the individual or person acting on their behalf on a reasonable basis.”

The patients whose information was transcribed into logbook 7 did not know that their data would be used for the purpose intended by the complainant. The data was excessive and it was not held securely.   By compiling this logbook, the complainant’s actions were in breach of the hospital’s data protection policy, the objective of which is to give effect to the provisions of the Data Protection Acts in the workplace.

Contract of Employment

Section 15 of the contract submitted in evidence is headed “Code of Conduct and Confidentiality” and provides that:

“You will understand that the nature of the services provided by the hospital and the nature of your position within the hospital are such as to require discretion and confidentiality in relation to your work and in relation to matters with which you may come into contact during the course of your work.

It is particularly important that you do not discuss or otherwise reveal save in the proper exercise of your duties any information whatsoever concerning the affairs of the hospital, its patients or employees.”

This section concludes with the statement:

“All employees are expected to be aware of and adhere to all Hospital policies and procedures.”

It is my view that, while these provisions are clearly set out in the contract of employment, they are a logical requirement of the job held by the complainant. Even if they were not stated in the contract, a reasonable person in a role such as that occupied by the complainant would assume that they must behave in accordance with a requirement for confidentiality and discretion. By compiling logbook 7, this requirement was forgotten or disregarded.

Code of Professional Conduct for Registered Nurses and Midwives

In simple and straightforward terms, this Code sets out the behaviours required of nurses under five principles. Principle 4 is headed “Trust and Confidentiality” and is concerned with confidentiality and honesty, the exercise of professional judgement and the expectation of patients that their personal information remains private.   Under the heading, “Standards of Conduct,” sub-section 4 is almost a statement of the obvious:

“You should respect and uphold a patient’s expectation that their personal information will remain private.”

For a nurse with many years of experience, it is difficult to understand how even a cursory reading of this Code of Conduct did not prevent the complainant from acting as she did. I agree with the finding of the investigation team that, by compiling the logbook, the complainant was in breach of this Code.  

I have considered the conclusions of the investigation team that the complainant breached the Data Protection Acts, the hospital’s data protection policy, her contract of employment and the Code of Conduct of the NMBI. It is my view that, technically, the hospital is responsible for the breach of the Data Protection Acts, but the complainant is responsible for the breaches of the data protection policy, her contract of employment and the NMBI Code.

It is my view that her action demonstrates a failure on her part to treat patient information as the property of the patients. She also failed to consider that patients have a right to expect that information provided by them is treated with respect and not used for any purpose other than what they intend it to be used for.

The complainant’s conduct in compiling the logbook is extremely serious and was not acceptable.   As an experienced nurse and as a person working with very vulnerable patients, it is difficult to understand why she took the action she did. I accept the sincerity of the complainant when she said that she regrets having compiled the logbook and I acknowledge that at the investigation, at the disciplinary meeting and at the hearing of this complaint, she was forthright and honest. Having considered all the evidence, I have to conclude that the decision to dismiss the complainant was not unreasonable.

Was the Process Fair?

On behalf of the complainant, the INMO raised a number of concerns about the process which ended with the dismissal of the complainant. In the first instance, they argued that the investigation team should have included an independent member. Referencing the case of Conway v HSE [2016] IEHC 73, they argued that Mr Justice Murphy’s view of the rights of employees to be consulted with regard to the composition of an investigation team applied in this case.   In his judgement, Murphy J stated:

“The right of an individual who is to be made subject to a disciplinary process, to have an input into the composition of the panel who are to conduct that investigation, is a right of real substance.   In all such disciplinary investigations, there is a potential inequality of arms in that the power of the institution is ranged against the individual. The requirement that the investigation team be agreed between the parties redresses that potential imbalance and is a material safeguard for the right of the individual to have a fair, unbiased and impartial hearing.”

This case arose from the RTÉ investigation in 2014 into the care of residents in the HSE-funded facility, Áras Attracta in County Mayo. Áras Attracta had a procedure in place for investigating abuse of patients known as the “Trust in Care Policy.” This provided that an investigation will be conducted “by the designated person(s) agreed between the parties.” The disciplinary procedure provided that investigations would be conducted by persons “acceptable to both sides.”

As a result of these inclusions in the Trust in Care Policy and the disciplinary procedure, the agreement of employees in Áras Attracta with regard to the composition of investigating and disciplinary panels became a contractual entitlement.   This entitlement does not apply to employees of the respondent because there is no provision in the hospital’s disciplinary procedure to have an external person participating in an internal investigation, nor is there a provision for agreement between the parties with regard to the composition of a disciplinary panel. Having considered the evidence, I am satisfied that the investigation was conducted in accordance with the procedures set out in the Code of Practice on Grievance and Disciplinary Procedures (SI 146 2000) which, at section 4(6) provides:

“That details of any allegations or complaints are put to the employee concerned;

That the employee concerned is given the opportunity to respond fully to any allegations or complaints;

That the employee concerned is given the opportunity to avail of the right to be represented during the procedure;

That the employee concerned has the right to a fair and impartial determination of the issues concerned, taking account of any representations made by or on behalf of the employee and any other relevant or appropriate evidence, factors or circumstances.”

The INMO’s position is that the complainant did not receive a fair and impartial determination of the issues. This contention is based on the refusal of the respondent to appoint an independent member of the investigation team and the fact that there was a “crossover” of senior managers between the suspension, the disciplinary hearing and the appeal hearing. I have already addressed the union’s request for an independent member on the investigation team.

The complainant was suspended by the HR Manager and the Secretary Manager. The HR Manager conducted the disciplinary hearing and the Secretary Manager conducted the appeal hearing. The purpose of suspension is to provide space and time for an investigation to take place and to eliminate the risk of further misconduct. No conclusions arise from the decision to suspend and, despite the effect on the employee, suspension must be seen as a neutral act. The disciplinary meeting resulted from the findings of the investigation team, and would not have taken place if the outcome of the investigation had been different. I find that no impartiality results from the involvement of the two managers in the suspension of the complainant, and their role in the disciplinary and appeal hearings.

The INMO referred to an EAT case, Bentley v Tesco Ireland Ltd, 818/2012, where the requirement for “vigilance, care and fairness” was highlighted by the chairman.

“In cases such as these where serious allegations are made attracting serious consequences to one’s reputation, career and general prospects or allegations bordering on or amounting to criminal liability, it is essential and imperative that the corresponding procedures adopted in the investigatory and disciplinary processes be carried out with the utmost vigilance, care and fairness, especially when the onus of proof lies on the party making such allegations.”

This statement was made by the Tribunal Chairman after a finding that the procedures adopted by the respondent were inadequate. The purpose of the statement is to explain the effect of what was not done by the respondent, Tesco Ireland Limited, in respect of how it carried out the disciplinary investigation. I am satisfied that, despite the INMO’s concern to have an independent person on the investigation panel, the investigation was carried out with vigilance, care and fairness, as prescribed by the Chairman in the Bentley v Tesco case.

In support of their contention that the disciplinary process was unfair, the INMO referred to the case of Frizelle v New Ross Credit Union Ltd [1997] IEHC 137, where Mr Justice Flood listed the premises that must be established to support a decision to terminate for misconduct, the first of which is:

“The complaint must be a bona fide complaint unrelated to any other agenda of the complainant.”

As it is referred to in this judgement, the complainant is the employer.

The union argued that management had “another agenda” and used the logbook issue as an opportunity to dismiss the complainant. A letter of December 8th 2014 from the HR Manager was submitted in evidence. This was an invitation to the complainant to attend a disciplinary meeting following a complaint against her by her line manager. In the end, an investigation did not take place, because, the same month, the complainant was approved to commence the Higher Diploma in Nursing in January 2015. The complainant said that she understood that the complaint was withdrawn because she wasn’t going to be working with her line manager any more.   Cross-examining the HR Manager, Ms Monaghan suggested that he had a pre-conceived idea about what had occurred between the complainant and her line manager; however, the HR Manager said that he could not recall meeting the complainant in 2014 and that this incident had no bearing on the logbook issue. I am satisfied that the logbook issue was serious enough to warrant a disciplinary investigation and the outcome is not related to the complaint of 2014.

The fourth principle set out by Mr Justice Flood in the Frizelle case is that “the decision of the deciding authority should be based on the balance of probabilities flowing from the factual evidence and in light of the explanation offered.” The INMO argued that the management did not consider the factual evidence and the explanation offered by the complainant to base their respective conclusions on the balance of probabilities. In this case however, there was no need to consider matters on the “balance of probabilities” – the facts were clear and there was no dispute about the logbook, the contents, the source of the contents or the author. The complainant’s explanation for compiling the logbook was challenged, but at no stage did the management conclude that the explanation was not credible.

The union also argued that the fifth principle in the Frizelle case was infringed by the hospital; that is, that the decision to dismiss should be “proportionate to the gravity of the complaint and the gravity and effect of the dismissal on the employee.” It is my view that, in general, managers involved in disciplinary proceedings resist the “nuclear option” of dismissal. Most managers appreciate that the key purpose of a disciplinary process is rehabilitation and, in arriving at a decision to dismiss, there are risks for the employee and the employer. In his evidence, the HR Manager said that in 18 years, he has presided over three or four dismissals. Taking into account the fact that the respondent is a hospital and employs hundreds of people, this shows that dismissal is arrived at by this employer only in very rare circumstances.

Conclusion

In compiling the logbook, the complainant copied patient data for her personal use, putting at risk the confidentiality of the records of 67 patients and creating further risks which are outside the scope of this decision to enumerate. In so doing, she fell far short of the nursing code of ethics which is rooted in respect for the dignity of the person and the requirement to respect the confidentiality of the interaction between patients and nurses.

I am mindful of Mr Justice Flood’s opinion that the decision to dismiss must take account of the “gravity and effect of the dismissal on the employee.” Listening to the evidence in this case, I was struck by the effect of the dismissal on the complainant and I acknowledge the further difficulties that this decision will have. At the hearing, the complainant said that she was back where she started in her career, working on a salary scale two grades lower than that which she was on when she was employed with the respondent.

Having considered all the evidence, verbal and written, and having taken account of the legal framework regarding the dismissal of an employee due to misconduct, and the legal precedents submitted by the INMO, I have to conclude that from a substantive and a procedural perspective, the decision to dismiss was not unfair and I find against the complainant.