Navarra high court reduces nurse’s prison sentence for unauthorised access to medical records

Two years of consultations, 150 medical records reviewed without authorisation and three victims: the long-term partner of the man with whom the nurse was in a relationship at the time, his sister and his daughter.

This is the outcome of a case that has resulted in a prison sentence for a nurse in northern Spain. Navarra's high court of justice (TSJN) has now reduced the prison sentence for this healthcare professional from five to three years.

Between 2018 and 2020, she accessed all these patient files. The civil and criminal chamber of the TSJN has taken into account the mitigating circumstance of undue delay as being "highly significant" to the sentence applied. This undue delay had already been accepted by the lower court in its ruling last December.

The TSJN concluded that there was "a very extraordinary paralysis of the proceedings", since more than three and a half years had elapsed between the filing of the prosecution's case (17 November 2021) and the presentation of the defense brief (8 April 2025).

In the ruling, which can be further appealed before Spain's Supreme Court, the TSJN reduced the prison sentence imposed by the provincial court for each of the three counts of continuous disclosure of private information from 20 months to 12 months. It also reduced the total fine from 4,860 euros to 3,780 euros, as well as the nurse's professional disqualification from 13 years and six months to nine years.

The TSJN, which ordered the nurse to pay the affected women compensation amounting to 15,000, 6,000 and 4,000 euros respectively, also declared Navarra's public health service (SNS) to be vicariously liable.

In the proven findings of the lower court's ruling, which the TSJN upheld in its entirety, the judges emphasised that the SNS "failed to exercise adequate control over staff access to the medical records" of these three women.

In its judgement, the TSJN as the court of appeal recognised two mitigating factors: reparation of damages, given that, prior to the trial, the defendant had deposited 10,000 euros (the amount requested by the prosecution) to cover civil liability and also the element of undue delay. Both were classified as "simple".

In its appeal, the defense asked the TSJN to recognise the mitigating circumstance of undue delay as "highly significant" and not "simple", which would lead to a reduction in sentence. Both the criminal prosecution and the private civil prosecution opposed this request.

However, the civil and criminal chamber of the TSJN ruled that there were "long periods of time" in the intermediate phase of the case being processed, leading to "a very extraordinary paralysis in the proceedings", especially in the time taken to prepare the defense brief. The court noted that this was "mostly due to unjustified procedural inactivity, meaning that the mitigating circumstance of undue delay must be upheld and classified as highly significant".

Click here for more stories about data protection.