A man used his flatmate's security card to get into a Wellington Hospital operating theatre and watch a three hour-plus cardiac bypass surgery - a breach discovered after he was asked about his medical studies and replied: "I'm a builder's apprentice."
The Weekend Herald has obtained the findings of an investigation into the extraordinary security and privacy breach, in which a medical student gave scrubs, directions and a swipe-card to her flatmate, who observed the entirety of the major surgery on August 25.
Capital & Coast DHB says the fact no formal procedure was in place to check students' ID cards when they entered theatres left an "unacceptable gap", exploited by an "enormous betrayal of trust".
• Man snuck into Wellington Hospital operating theatre during major surgery, allegedly disguised in borrowed scrubs
• Auckland City Hospital investigates four deaths of mothers - husband speaks of being kept from hospital under lockdown
• Heartbreak and bravery amidst our deadliest Covid outbreak
"Our systems have failed the patient and their family in this case," Chief Medical Officer John Tait said.
"This was a clear breach of the code of conduct that students sign when starting a placement."
However, the University of Otago - which is yet to complete its own investigation - says its student has "explained that they believed they had followed appropriate process to arrange attendance at the procedure for a third party who aspired to study medicine".
The student was in the final year of a six-year degree, and completed a six-week placement at Wellington Regional Hospital's intensive care unit. She was "well regarded as an enthusiastic, hardworking student and gained the trust of the medical staff they worked with", stated the DHB's report, which was released under the Official Information Act.
Trainee interns often observe cardiac elective surgeries, with patient permission, and the student in question did so in June. In August, she messaged a cardio-thoracic registrar who helped organise that, asking, "I have an aspiring cardiothoracic surgeon called [name redacted] who would be very keen to see a case. Let me know if that would be possible."
The student used an IT system to look up a surgery, which the DHB says was a breach as it wasn't for the performance of her duties, and followed up with the registrar, "just regarding my friend coming to see some cases we were wondering if Tuesday works".
"Tuesday would work well," the doctor replied. "I'll be around so they can call me around 7.30-8am and we can work something out."
That morning, August 25, the builder's apprentice texted the registrar, and was told to meet at the theatre. He entered the hospital through a connecting door to the Otago School of Medicine, dressed in scrubs, overshoes and a hat, and used the medical student's swipe card to get into the theatre area.
The registrar introduced him to another doctor as a medical student, the report stated. The patient (who had consented to a medical student being present) was in theatre, but it's unclear if at that point they were sedated, or unconscious.
A student would usually be introduced and their name written on a white board, but staff said they couldn't remember if this happened.
The man - now in a mask and goggles - stood at the head of the bed and watched for about 3.5 hours. The anaesthetist showed him where to stand and discussed the operation.
"The observer never interacted or touched [the patient] at any point during the operation. The observer knew how to move round the operating theatre in order to avoid equipment and the sterile field [an area kept free of microorganisms to protect against infection]," the DHB report stated.
"When watching the operation the observer leant forward over the sterile barrier with hands positioned behind their back. Theatre staff commented that: 'It felt like the observer had been coached on how to behave in theatre.'"
Between 12.20 and 12.40pm the surgeon left the theatre, and the cardio-thoracic registrar who had exchanged the text messages completed suturing of the chest wall. They asked about his plans after graduation, and if his suturing skills were any good.
"Not very good," he replied.
"When's your final exam, where are you next year?" the doctor asked, according to the report.
"I'm not a medical student," he said. "I'm hoping to start in three years' time. I'm a builder's apprentice."
The man gave his thanks and left. The registrar - after calling the surgeon to relay the news - sent him a text: "I didn't realise that you aren't a medical student! Maybe best not to tell anyone that you came in today. We would usually follow a bit of a different process for people who aren't medical students!"
He apologised - "I thought [the medical student] may have mentioned it" - and promised to keep what he'd witnessed to himself.
Among those alerted were the DHB's chief executive and the university's Pro Vice Chancellor. The Privacy Commissioner was told, and the police were contacted (they declined to take any action).
Just after 2pm, the medical student was reached by phone.
"[She] said the observer was a housemate who wanted to see an operation," the DHB report stated. "[She] described feeling upset and felt sick."
The report made recommendations including for a formal process to check medical students' identities on theatre entry (already actioned) and for Otago to review information and training. Reviewers didn't interview the medical student or builder's apprentice.
"We really don't know what was going on in the minds of either the medical student or the observer. They may be questions that the university can answer," Tait said.
"The student did access information from our systems which is against code of conduct. The giving of a security card is also against any code of conduct."
All staff had assumed the man was a medical student, Tait said, and the registrar's text message was to try "ensure that this person didn't go telling [his] mates what he saw at the operation".
Asked if he was disappointed police didn't take action, he said, "their view, and probably very correctly, was it was our processes which had allowed this to happen, rather than the person being there under false pretences" (when the Weekend Herald broke the story last month Tait said false pretences were used).
He again apologised to the patient and their family.
The student is currently unable to undertake clinical placements, and the university and Medical Council are considering what further action might be taken.
A University of Otago spokesperson said it agreed with the DHB recommendations, and is working to "eliminate the possibility of any future incident of this kind". Its own investigation is ongoing, and focuses on the student's explanation that they believed appropriate process was followed.
Tait, who has been a consultant obstetrician and gynaecologist in Wellington since 1986 and chairs the Health Quality & Safety Commission, said he had never heard of such a case.
"We have had unauthorised people in hospitals, but not in theatre."