NHS Tayside has apologised to almost 400 patients whose records were accessed by a Ninewells Hospital scientist who was subsequently fired for gross misconduct.
Dr Glen Gardner was dismissed in June last year after accessing patient records 497 times while assigned to non-clinical duties.
The breach came to light after Gardner, who claimed he had a legitimate reason for accessing the records, had his claim for unfair dismissal refused.
The health board said it was contacting patients directly to offer "a sincere apology".
It said the incident was reported to the Information Commissioner's Office (ICO), which found that there was "no evidence that the personal data left NHS Tayside's systems".
The employment tribunal, which was first reported in The Herald, took place in Dundee over three days in August.
The tribunal was told that the records were accessed by the scientist in 2023 and 2024.
Gardner had been employed as a clinical scientist for more than 15 years.
He was transferred to a non-clinical project in 2023 after allegations of "erroneous" advice he had given to a patient concerning her breastfeeding while undergoing treatment were investigated.
In May 2024, a colleague noticed that Gardner was using the patient records system, known as CRIS, and was in the record she was accessing.
She queried with a senior colleague why Gardner was accessing records as she had previously been told he was assigned to alternative duties.
A subsequent review established that Gardner had accessed almost 400 patient records on CRIS, some on multiple occasions.
The breach was reported to the ICO, which suggested that the police and the 386 impacted patients were informed.
During an investigatory meeting, Gardner admitted accessing the records, but disputed that his role had been changed.
He claimed "no discussions were held that my role was changed, just my location" and said he had not been instructed "in writing" not to use CRIS.
Gardner said he had explanations for accessing the records, including performing an audit of breastfeeding patients.
He added that he had not "recorded the audit as yet" and would do this on his return to the department "when my clinical systems had been reinstated".
The tribunal said Gardner did not provide a satisfactory explanation why he had accessed the data or provided evidence of its use for legitimate reasons.
Employment Judge Paul Rae concluded that the NHS Tayside board had acted reasonably in treating Gardner's misconduct as "a sufficient reason for dismissal".
'No evidence of harm to patients'
A spokesperson for NHS Tayside said "Following a comprehensive investigation under NHS Scotland workforce policy, it was identified that personal information was viewed inappropriately by a single member of staff.
"This staff member was dismissed in June 2025."
The spokesperson said the employment tribunal had backed the dismissal.
They added: "NHS Tayside reported the incident to the Information Commissioner's Office who found that there was no evidence that the personal data left NHS Tayside's systems.
"Patients who have been affected are being contacted directly to explain what happened to their information in detail and to offer a sincere apology."
An ICO spokesperson confirmed it had received a report from NHS Tayside and the conclusion of the investigation and disciplinary process.
The spokesperson added: "Having considered the circumstances of the case, including the action taken by NHS Tayside, the employee's dismissal and the fact that there was no evidence of harm to patients, we decided it was not in the public interest to pursue criminal prosecution or further regulatory action in this case."