Mrs Shaila N Yunus

Profession: Physiotherapist

Registration Number: PH107185

Hearing Type: Final Hearing

Date and Time of hearing: 10:00 28/10/2019 End: 17:00 31/10/2019

Location: Novotel Manchester Centre 21 Dickinson Street, Manchester, Greater Manchester, M1 4LX

Panel: Conduct and Competence Committee
Outcome: Caution

Please note that the decision can take up to 5 working days to be uploaded onto the HCPTS website. Please contact one of our Hearings Team Managers via tsteam@hcpts-uk.org or +44 (0)808 164 3084 if you require any further information.

 

Allegation

Whilst registered as a Physiotherapist, you:

1. Accessed Patient Y's electronic medical records without any clinical justification
on:

a) 03/04/2017
b) 05/04/2017
c) 07/04/2017
d) 10/04/2017
e) 11/04/2017
f) 13/04/2017

2. On 03/04/2017 printed document/s from Patient Y's records

3. On an unknown date after 3/04/2017, posted pages from Patient Y's medical records to a member of the public

4. On 03/04/2017 accessed electronic medical records without any clinical justification relating to:

a) Patient A
b) Patient B
c) Patient C
d) Patient D
e) Patient F
f) Patient G
g) Patient H

5. The matters set out in paragraphs 1 - 4 constitute misconduct.

6. By reason of your misconduct your fitness to practise is impaired.

Finding

Preliminary Matters

Parts of the Hearing to be in Private

1. Mr Henry, Counsel representing the Registrant, applied for the entirety of the hearing to be held in private. Mr Olphert, on behalf of the HCPC, did not object to the application.

2. The Panel, noted the agreement of the parties and determined to hold the whole of the hearing in private. It was satisfied that it was justified to hear the entirety of the case in private.

3. As such, this is the redacted version of the decision.

Application to Amend

4. At the beginning of the hearing, Mr Olphert, on behalf of the HCPC, applied to amend Particular 4, in order to remove ‘Patient E’ from the sub-particulars. He explained that the anonymity key indicated that the identification of Patient E, was in fact Patient A, who was already particularised in 4(a). Mr Henry did not oppose the application.

5. During the course of the HCPC evidence, Mr Olphert further applied to amend the allegation in respect of the named employer. The employer had originally been incorrectly identified. Mr Henry did not object to the application.

6. Having heard and accepted the advice of the Legal Assessor, the Panel decided to allow both proposed amendments. It was clear that there had been an error in adding an additional patient, Patient E, when Patient E was in fact Patient A, in respect of whom there was already an allegation. It was also clear that the Registrant’s employer had been incorrectly identified, and it was appropriate to correct it. Neither proposed amendment, in the Panel’s view, materially affected the nature of the allegation against the Registrant. Therefore, the Panel was satisfied that there would be no prejudice to the Registrant in allowing either of the proposed amendments.


Background

7. The Registrant is a Physiotherapist registered with the HCPC. The Registrant was employed by the Trust from 13 June 2016 as a qualified Band 5 Physiotherapist. On 6 March 2016, she was promoted to a Band 6 Physiotherapist, working in musculoskeletal outpatients.

8. The Registrant’s responsibilities included performing specialist assessments and treatment of patients, determining a clinical diagnosis, developing, implementing, evaluating and modifying individualised treatment programmes and managing her own clinical case load while supervising junior Physiotherapists and therapy assistants.

9. As part of the Registrant’s induction on starting at the Trust, she would have completed a face to face Information Governance session on 13 June 2016. Completion of mandatory refresher training on Information Governance was an annual requirement at the Trust, and the Registrant would have been required to complete the refresher training in respect of Information Governance by 12 June 2017. In addition, monthly departmental meetings were held, at which governance updates were provided. Information Governance policies were also available on the Trust’s intranet.

10. Part of the Trust’s Information Governance system comprised an electronic data base called the Automated Letters System (ALS). The ALS system stored copies of all of a patient’s clinical letters generated by all departments within the Trust.

11. On 5 April 2017, the Trust’s complaint department received a complaint from Patient Y about accessing her records and sending them to a third party.

12. As a consequence of the complaint, an (Information Technology) IT audit was undertaken by the IT security department. It indicated that the Registrant’s ALS login details had accessed Patient Y’s records. Patient Y was not under the care of the physiotherapy department.

13. It is alleged that the Registrant had accessed Patient Y’s electronic medical records without clinical justification on several days in April 2017, as set out in Particular 1. It is further alleged that she printed off documents from Patient Y’s records (Particular 2), and posted them to a third party, member of the public (Particular 3).

14. On 18 April 2017, AB, then a Physiotherapy Manager within the Trust, held an initial informal meeting with the Registrant. At the meeting the Registrant denied the allegations.

15. On 24 April 2017, AB was formally appointed to conduct a Trust disciplinary investigation into the allegation. She conducted disciplinary meetings with the Registrant and her union representative on 2 May 2017 and 15 May 2017.

16. Following the meeting on 15 May 2017, AB requested a further IT audit to confirm whether legitimate records could have been printed off on the same date that it was alleged that Patient Y’s records were printed. The second audit indicated that the Registrant’s ALS login details had accessed records for Patients A, B, C, D, F, G and H on 3 April 2017. None of the patients was under the care of the physiotherapy department. It is alleged that the Registrant accessed the records of these additional patients without clinical justification (Particular 4).

17. On 30 May 2017, a third disciplinary meeting was held with the Registrant. During this meeting the Registrant denied accessing any of the additional records and suggested that the student that she was supervising at the time may have accessed ALS using her login.

18. Patient Y had referred the matter to the HCPC on 26 April 2017. On 16 June 2017, AB also referred the matter to the HCPC.


Decision on Facts

19. At the outset of the Hearing, the Registrant admitted each of the factual particulars, except for Particular 1(c). During the course of the evidence, the Registrant further admitted Particular 1(c).

20. The HCPC called two witnesses. AB was, at the time a Physiotherapy Senior Manager at the Trust. She was appointed to conduct the Trust’s disciplinary investigation. DB was, at the time a student Physiotherapist on a placement at the Trust and the Registrant was his supervisor.

21. The Panel also received a witness statement from Patient Y.

22. The HCPC provided a bundle of documents, which included AB’s Trust Investigation Report dated 30 May 2017; copies of the disciplinary meetings with the Registrant; email of Patient Y’s complaint; copies of photographs of envelope and discharge letter regarding Patient Y; ALS logs; printer log; and relevant policies.

23. The Registrant gave evidence, and provided a bundle of documents, which included her witness statement; a witness statement from her current employer, KA; certificates of training; and testimonials from past and current professional colleagues.

24. The Panel heard and accepted the advice of the Legal Assessor. Although the Registrant admitted each of the particulars of fact relating to factual matters, the Panel recognised that it had to be satisfied that those particulars of fact were capable of proof. The Panel recognised that the burden of proving each individual fact rests on the HCPC and that the HCPC will only be able to prove a particular fact if it satisfies the required standard of proof: namely the civil standard, whereby it is more likely than not that the alleged incident occurred.

25. At the outset of its deliberations, the Panel considered the credibility and reliability of each of the witnesses called.

26. In relation to AB, the Panel found her to be a credible and impartial witness. She was very helpful in respect of the documentation which had been produced, was knowledgeable about how the ALS system worked and how it had been interrogated. The Panel considered that she was candid when she could not recall matters, for example in relation to access of records on 7 April 2017, when the Registrant’s own login was not used, and her memory was prompted by the table of logins set out in her Investigation Report. The Panel was satisfied that it could rely on her evidence.

27. In relation to DB, the Panel found him to be a credible witness on the narrow point on which he gave evidence, and that it could rely on his evidence.

28. In relation to the Registrant, the Panel considered her evidence to be very credible. It considered that she was trying to be totally open and honest as a witness, and accepted all responsibility for her actions.

29. In relation to KA, the Panel considered that her evidence was reliable. She was clearly very knowledgeable and professional, and genuinely wanted to assist the Panel.

Particular 1

30. The Panel finds Particulars 1(a), 1(b), 1(d), 1(e), and 1(f) proved on the basis of AB’s evidence, the IT login audit and the Registrant’s admissions.

31. The Panel finds Particular 1(c) proved on the basis of AB’s evidence and the Registrant’s admission.

Particular 2

32. The Panel finds Particular 2 proved on the basis of AB’s evidence, the print log, and the Registrant’s admission.

Particular 3

33. The Panel finds Particular 3 proved on the basis of the agreed hearsay statement of Patient Y, copies of the documents exhibited by Patient Y and the Registrant’s admission.

Particular 4

34. The Panel finds Particular 4(a) to (g) proved on the basis of AB’s evidence, the IT login audit, DB’s evidence and the Registrant’s admissions.


Decision on Statutory Ground

35. Having found all of the facts proved, the Panel next considered whether the particulars found proved amounted to misconduct, and if so, whether by reason thereof, the Registrant's fitness to practise is currently impaired.

36. The Panel considered the submissions made by Mr Olphert on behalf of the HCPC. He submitted that the Registrant’s actions had breached a number of the HCPC Standards of conduct, performance and ethics, and amounted to misconduct.

37. The Panel noted that the Registrant had admitted misconduct at the outset of the case, and that Mr Henry, on her behalf, accepted that the Registrant’s actions amounted to misconduct.

38. The Panel heard and accepted the advice of the Legal Assessor. The Panel was aware that any findings of misconduct and impairment were matters for the independent judgement of the Panel.

39. The Panel was of the view that the matters found proved fell far below the standards of acceptable behaviour for a registered professional. It considered that the Registrant’s actions had been deliberate.

40. In the Panel’s view, the Registrant had breached the requirements for patient confidentiality, data protection, and the trust placed in her as a registered professional. It noted that a Physiotherapist has privileged access to confidential and sensitive material regarding patients and any actions abusing that privilege have the potential to damage patients’ trust in professionals.

41. The Panel considered the HCPC’s published standards required of Registrants: ‘Standards of conduct, performance and ethics’ (2016 version). In the Panel’s judgement, the Registrant had breached the following standards:

• 1.1: You must treat service users and carers as individuals, respecting their privacy and dignity.

• 1.4: You must make sure that you have consent from service users or other appropriate authority before you provide care, treatment or other services.

• 5.1: You must treat information about service users as confidential.

• 5.2 You must only disclose confidential information if:
- you have permission;
- the law allows this;
- it is in the service user’s best interests; or
- it is in the public interest, such as if it is necessary to protect public safety or prevent harm to other people.

• 6.1: You must take all reasonable steps to reduce the risk of harm to service users, carers and colleagues as far as possible.

• 6.2: You must not do anything, or allow someone else to do anything, which could put the health or safety of a service user, carer or colleague at unacceptable risk
• 9.1: You must make sure that your conduct justifies the public’s trust and confidence in you and your profession; and

• 10.3: You must keep records secure by protecting them from loss, damage or inappropriate access.

42. The Panel concluded that the Registrant‘s actions would be considered by fellow professionals as being ‘deplorable’ and ‘morally blameworthy’. In all the circumstances, the Panel concluded that the Registrant’s actions amounted to misconduct.


Decision on Impairment

43. Having found misconduct, the Panel went on to consider whether the Registrant’s fitness to practise is currently impaired. The Panel accepted the advice of the Legal Assessor and had regard to the HCPTS Practice Note on Impairment and in particular the two elements of impairment, namely the ‘personal component’ and the ‘public component’, as identified from the case law.

44. The Panel first considered the ‘personal component’, and in particular the factors of insight, remorse, remediation, all of which are relevant to its assessment of the likelihood of repetition.

45. References received on behalf of the Registrant attested to no other concerns either before or since that time. There were also no issues in respect of her clinical practice or competence.

46. The Panel considered that the Registrant had considerably reflected on her actions over the last two years. The Panel considered that she had been very candid in her evidence to it. She accepted that she had been less than transparent during the Trust’s disciplinary investigation, initially denying her actions and then making only partial admissions to the Trust. Nevertheless, the Panel considered that the Registrant was in no doubt as to the egregious nature of her misconduct, making full and frank admissions in these proceedings.

47. The Panel considered that the Registrant’s reflections had also involved wider consideration of the impact of her actions. She recognised that her deliberate data breach had broken the trust placed in her as a professional by others, including managers, patients and the HCPC, and accepted that the public would rightly regard her misconduct as serious. As a result she understood the importance of her trying to re-build that trust, and that it was an ongoing process.

48. The Panel had regard to the training which the Registrant had undertaken over the period since her misconduct. The Panel noted that this included relevant courses in General Data Protections Regulations (GDPR); privacy at work; GDPR awareness; Information Security; and consent. The Panel considered that the Registrant had developed a good understanding of the importance of patient confidentiality and data protection and was able to articulate her practical use of her knowledge in her current employment.

49. The Panel had regard to the evidence of KA, the Registrant’s current Line Manager. The Registrant had started at Pure Physiotherapy in June 2018. KA explained that the Registrant had disclosed the HCPC investigation to her. As a result, KA had undertaken additional audits in respect of the Registrant’s use of their electronic data management system. This had initially comprised regular weekly audits as well as spot checks. Since the Registrant had started, KA had no concerns about the Registrant.

50. The Panel also had regard to the testimonials of past and present professional colleagues of the Registrant, which attested to a high level of commitment and dedication on the part of the Registrant. They also attested to her usual high standards of conduct and behaviour, including professionalism, and integrity.

51. In light of all the information before it, in the Panel’s judgement, the Registrant had incrementally developed her insight since her actions in June 2017, such that she had now developed a very good level of insight. She had undertaken regular relevant training to achieve a high level of knowledge about patient confidentiality and data protection, and was clearly putting such knowledge into practice in her employment, as attested to by KA. 

52. In all the circumstances, the Panel considered that the Registrant had remediated her misconduct, and consequently, it considered that there was a low risk of repetition. Therefore, the Panel concluded, from all the material before it, that in respect of the personal component, the Registrant’s fitness to practise is not currently impaired.

53. The Panel went on to consider the ‘public component’, and in particular the effect the Registrant’s actions would have on public confidence in the profession.

54. The Panel was of the view that the Registrant’s actions had been particularly serious. In considering her culpability, the Panel was mindful that the Registrant’s actions had been deliberate.

55. In the Panel’s view, it is paramount that the public is able to trust the integrity of members of the profession with confidential and sensitive information. Individual patients, as well as the general public, need to have confidence that Physiotherapists will treat patient records in a fair manner; respecting confidentiality; and having regard to the sensitive nature of the personal and medical information provided.

56. In all the circumstances, the Panel concluded that a finding of impairment was required to declare and uphold proper standards of conduct and behaviour. It was of the view that public confidence in the profession and the Regulator would be undermined if it did not make a finding of impairment, as the public would be left with the impression that no steps had been taken to draw to the Registrant’s attention, the profound unacceptability of her behaviour in June 2017.

57. Accordingly, in respect of the ‘public component’ the Panel concluded that the Registrant’s fitness to practise is currently impaired.


Decision on Sanction

66. Having determined that the Registrant’s fitness to practise is currently impaired by reason of her misconduct, the Panel next went on to consider whether it was impaired to a degree which required action to be taken on her registration.

67. The Panel took account of the submissions of Mr Olphert on behalf of the HCPC and those of Mr Henry on behalf of the Registrant. It also had regard to all the evidence it had heard, and all of the material previously before it.

68. The Panel accepted the advice of the Legal Assessor and it exercised its independent judgement. It had regard to the most recent version of the HCPC Sanctions Policy (the Policy) and considered the sanctions in ascending order of severity. The Panel was aware that the purpose of a sanction is not to be punitive but to protect members of the public and to safeguard the public interest, which includes upholding standards within the profession, together with maintaining public confidence in the profession and its regulatory process.

69. Before considering the individual options open to the Panel, it considered the significant aggravating and mitigating features, which have previously been identified at the misconduct and impairment stage of this case.

70. The Panel considered the following to be the significant aggravating factors:

• the Registrant’s actions had been a breach of trust;
• the Registrant had abused her professional position by her inappropriate access and the sending out of confidential information;
• the Registrant’s actions had caused harm to Patient Y.

71. Panel considered the following to be the significant mitigating factors:

• the Registrant has developed very good insight into her actions;
• the Registrant has apologised for her actions and shown genuine remorse;
• the Registrant has undertaken a significant amount of relevant training;
• the Registrant has remedied her misconduct;
• there is a low risk of repetition;
• the misconduct itself had been relatively isolated and the most serious aspect of the misconduct had been limited to a single patient;
• the Registrant has fully engaged with the HCPC regulatory process;
• the Registrant is a highly regarded clinician, as demonstrated by the evidence of her current employer and her references and testimonials; and
• the Registrant has no previous or subsequent concerns regarding her conduct or practice.

72. The Panel first considered whether a sanction was necessary. It was mindful that the Policy specifically identified as serious cases those in which there had been an abuse of professional position. The Panel also had regard to its earlier findings of misconduct and impairment, where it recognised that it is paramount that the public is able to trust the integrity of Physiotherapists with confidential and sensitive information. The Panel was of the view that the case was too serious to take no action, and that such a course would send the wrong message to the public. It concluded that some form of sanction was necessary to maintain public confidence in the profession and to declare and uphold proper standards of conduct and behaviour.

73. The Panel next considered whether to impose a Caution Order. Having regard to the Policy, it was of the view that paragraph 101 was particularly relevant in this case. It states:

‘A caution order is likely to be an appropriate sanction for cases in which:
• the issue is isolated, limited or relatively minor in nature;
• there is a low risk of repetition;
• the registrant has shown good insight; and
• the registrant has undertaken appropriate remediation.’

74. In relation to whether the issue was isolated, limited or relatively minor in nature, the Panel was of the view that the case could properly be described as one in which the issue was relatively isolated and limited.

75. The Panel considered that the other factors relevant for a Caution Order were present in this case. The Panel’s conclusions at the impairment stage were that there was a low risk of repetition, the Registrant had shown very good insight and had remedied her misconduct.

76. However, the Panel did not consider that the issue was ‘relatively minor in nature’. It was mindful that the Policy categorised the abuse of one’s professional position by the inappropriate accessing of confidential information as a serious case. The Panel also had regard to its earlier conclusions that the Registrant’s actions had been particularly serious, and that a Physiotherapist who breached the requirements for patient confidentiality, data protection, and the trust placed in them, risked damaging patients’ trust in such professionals. The Panel noted that paragraph 101 of the Policy, by the use of the word ‘or’, did not appear to require all three factors of being isolated, limited and relatively minor in nature to be present in order for a Caution Order to be appropriate.

77. The Panel nevertheless went on to consider whether the seriousness of the misconduct itself, notwithstanding the extensive remediation, ruled out a Caution Order as being the appropriate and proportionate sanction in all the circumstances. In this regard, the Panel took account of paragraph 102  of the Policy, which states:

‘A caution order should be considered in cases where the nature of the allegations mean that meaningful practice restrictions cannot be imposed, but a suspension of practice order would be disproportionate…’

78. The Panel had regard to its earlier findings that the Registrant was not impaired in respect of the personal component, given that it had concluded that she had very good insight; had apologised for her actions; and had remedied her misconduct. There were also no issues with her clinical practice. In light of this, the Panel was of the view that there were no meaningful practice restrictions which could be imposed on the Registrant’s practice, and so a Conditions of Practice Order was not appropriate in his case.

79. Therefore, the next applicable sanction to consider in the hierarchy of sanctions, if a Caution Order was not appropriate, was that of a Suspension Order.

80. Given all of the above, the Panel concluded that a Suspension Order would be disproportionate and unduly punitive in the particular circumstances of this case. The Panel acknowledged that the Registrant’s actions had been particularly serious. However, the Panel has had the benefit of assessing the Registrant in her evidence, of hearing from her current employer and of reading references and testimonials from professional colleagues in respect of the Registrant’s usual high standards of practice, conduct and behaviour. The Panel has had the opportunity to assess and understand the Registrant’s level of insight, remorse, reflection and has concluded that there is a low risk of repetition. The Panel also noted that a Suspension Order would deprive the public of the services of an otherwise highly regarded Physiotherapist while it was in place.

81. In all the circumstances, and having regard to the principle of proportionality, the Panel determined that the appropriate and proportionate sanction in this case is a Caution Order.

82. The duration of the Caution Order will be for a period of two years. A shorter period would not, in the Panel’s view, be sufficient to mark the seriousness of the misconduct. The Panel did not view a Caution Order as a lenient sanction. It would appear on the Register for two years, and potentially affect the Registrant’s reputation, and may have consequences for her client base and practice. The Panel was satisfied that a Caution Order for a period of two years would appropriately mark the seriousness of the case. It would serve to maintain confidence in the profession, for both members of the public and fellow professionals, by demonstrating that the Registrant’s actions had been wholly unacceptable and had led to disciplinary proceedings by her regulator resulting in a finding of impaired fitness to practise and a sanction.

Order

The Registrar is directed to annotate the register entry of Mrs Shaila N Yunus with a caution which is to remain on the register for a period of two years from the date this order comes into effect.

Notes

No notes available

Hearing History

History of Hearings for Mrs Shaila N Yunus

Date Panel Hearing type Outcomes / Status
28/10/2019 Conduct and Competence Committee Final Hearing Caution