Health Ombudsman v Rathie [2026] QCAT 180: Confidentiality, Consent, Digital Publication and the Significance of Insight in Health Practitioner Disciplinary Proceedings

This article was written by Senior Associate Ren Li for the Australian Health Law Bulletin.

Introduction

The Queensland Civil and Administrative Tribunal’s , (the ‘Tribunal’) decision in Health Ombudsman v Rathie  [1][2026] QCAT 180 gifts us with a contemporary examination of patient confidentiality, professional misconduct and the disciplinary consequences of inappropriately publishing patient-related material. The decision arises from the publication of The Anaesthetic Picture Book, a self-published book authored by an experienced anaesthetist which contained photographs and commentary derived from his clinical practice in a public hospital. The case is noteworthy not only because of the nature of the conduct, but also because of the Tribunal’s detailed consideration of de-identification, consent, digital publication, professional values and the role of insight and remediation in determining the appropriate sanction.

The primary issue before the Tribunal concerned the appropriate disciplinary action, as the parties had agreed that the respondent’s conduct constituted professional misconduct. The Tribunal ultimately imposed a reprimand and a fine of $30,000, while accepting that the respondent had demonstrated substantial insight, remorse and rehabilitation.

The decision gives important guidance for health practitioners navigating confidentiality obligations in an era where personal publishing platforms, online marketplaces and social media provide unprecedented opportunities for dissemination of information. It also highlights the ongoing importance of patient consent and demonstrates that de-identification alone will not necessarily satisfy professional obligations relating to patient privacy.

Background

The respondent was a highly experienced anaesthetist who had been registered since 1994 and had practised at Toowoomba Base Hospital for many years. He had also held a number of professional leadership, mentoring and examiner roles within the Australian and New Zealand College of Anaesthetists. Prior to the events in question, he had established himself as an author, publishing six books between 2015 and 2022 on subjects relating to anaesthetic practice, training and professional development.[2]

In about 2022, the respondent decided to write a book depicting his day-to-day life as an anaesthetist. He adopted a photo-based format containing one image for each day of the year (although not necessarily corresponding to that day). Throughout 2023, he regularly took photographs using his mobile phone[3] while working at Toowoomba Base Hospital with the intention of using them in the book. The book was eventually published through Amazon in 2023.

The introduction to the book described it as a compilation of images collected during work as an anaesthetist in a “busy regional hospital in Queensland” and stated that “all identifying material of individuals has been removed”. The publication also contained a number of quiz-style features intended to educate or entertain readers.

The respondent ordered 15 author copies, distributed these copies to family, colleagues and friends, placed a copy in the hospital theatre room and promoted the book through posters in staff areas. Eight copies were sold through Amazon, including five in the United States and three in Australia. Following concerns raised by Darling Downs Hospital and Health Service, the respondent removed the book from sale, attempted to recover sold copies and arranged for author copies to be returned and destroyed.[4]

The Office of the Health Ombudsman referred two allegations to the Tribunal. The first concerned breaches of patient confidentiality and privacy arising from the taking and publication of photographs without patient consent. These photographs included clinical records, medical imaging, surgical procedures, patients undergoing examination or treatment, and associated commentary concerning patients’ conditions and personal characteristics. The second allegation concerned the publication of inappropriate and insensitive commentary about patients, including remarks about their weight and other personal characteristics. The Tribunal’s concern extended to both the misuse of patient information and the broader professional values implicated by insensitive commentary about vulnerable individuals receiving medical care.[5] ? footnote relevant paragraphs in judgement

Professional Misconduct and the Code of Conduct

The parties had agreed that the respondent’s conduct constituted professional misconduct. The Tribunal accepted this position and referred to both the statutory definition of professional misconduct and the standards contained in Good Medical Practice: A Code of Conduct for Doctors in Australia.[6] Footnote reference relevant paragraphs in judgement  and footnote reference to the Code

[26] Professional misconduct is defined at s 5 of the National Law as:

• unprofessional conduct by the practitioner that amounts to conduct that is substantially below the standard reasonably expected of a registered health practitioner of an equivalent level of training or experience; and
• more than one instance of unprofessional conduct that, when considered together, amounts to conduct that is substantially below the standard reasonably expected of a registered health practitioner of an equivalent level of training or experience; and
• conduct of the practitioner, whether occurring in connection with the practice of the health practitioner’s profession or not, that is inconsistent with the practitioner being a fit and proper person to hold registration in the profession.

[27] Pursuant to section 41 of the National Law, the relevant codes of conduct are admissible in proceedings against a health practitioner, as evidence of what constitutes appropriate professional conduct or practice for the health profession. 

The Tribunal found that the conduct breached multiple provisions of the Code, including requirements that practitioners act ethically, maintain confidentiality, protect patient privacy, demonstrate integrity and justify community trust in the profession. The conduct was found to represent a substantial departure from the standards expected of a practitioner of equivalent training and experience.[7] Footnote relevant paragraphs in judgement

Importantly, the Tribunal considered the conduct inconsistent with fundamental professional obligations. The publication of photographs obtained through clinical practice, accompanied by commentary concerning patients’ conditions and personal circumstances, constituted a serious betrayal of patient trust. In the Tribunal’s view, the conduct reflected a profound failure of professional judgment.[8] Footnote relevant paragraphs in judgement

De-identification is Not a Substitute for Consent

One of the most significant lessons arising from the decision concerns the limits of de-identification. The respondent’s book expressly asserted that all identifying material had been removed from the images contained within it. On one view, this statement demonstrates that the respondent had at least considered confidentiality issues and believed that removal of identifying information was sufficient to protect patient privacy.

The Tribunal’s reasoning reveals the limitations of that assumption. It found that the risk of identification remained because the book repeatedly referred to the respondent’s regional place of practice, included photographs taken within the hospital, contained images of colleagues and reproduced hospital-related material. These contextual details significantly increased the possibility that individual patients could be recognised despite the removal of direct identifiers.[9]

The decision reflects a broader and more contemporary understanding of privacy. Patients may be identifiable through the cumulative effect of multiple pieces of information, even where names, dates of birth and other obvious identifiers have been removed. In smaller communities, specialised clinical settings or regional hospitals, seemingly innocuous details may be sufficient to permit identification.

More fundamentally, Rathie demonstrates that confidentiality obligations are not solely concerned with identifiability. The Tribunal repeatedly emphasised that patients had not consented to the collection or publication of the material. Even if de-identification had been entirely successful, the absence of patient consent remained a significant ethical and professional concern.[10] footnote relevant paragraphs in judgement The case therefore affirms that de-identification is a risk-management measure rather than a substitute for informed patient consent.

Dignity and Patient Vulnerability

A notable feature of the case is the Tribunal’s attention to the nature of the accompanying commentary. It found that certain comments were demeaning, insensitive and disrespectful. The issue was how patients were represented and the Tribunal regarded aspects of the commentary as demonstrating a lack of compassion and a disregard for patient vulnerability.

[42] The Respondent used his position to take photographs of patients and clinical records, without the patients’ knowledge or consent, in breach of their privacy and confidentiality, over a period of approximately two years.  Most concerningly, he also provided commentary with the photographs that was, in parts, demeaning, insensitive and disrespectful. 

[43] Some examples include:

• providing a photo of a child’s genitalia, whose testes were twisted around the spermatic cord;
• providing inappropriate commentary about an object removed from the rectum of a patient, in circumstances where the patient was not one of his own;
• providing commentary which suggested a particular person frequently self harmed; and
• commentary that accompanied a patient’s medical chart (unnamed) ‘…the over 200kg club are almost always “easy” intubations.’

Patients frequently engage with healthcare services at times of considerable distress, illness and personal vulnerability. The therapeutic relationship depends not only upon technical competence but also upon trust that healthcare practitioners will treat patients with dignity and respect. The publication of comments concerning patients’ bodies, health conditions or personal circumstances for amusement risks undermining that trust.

Consequently, Rathie is a reminder that professional misconduct may also be found not only because confidential information has been disclosed, but because the manner in which patients are portrayed is inconsistent with the ethical values underpinning medical practice. The decision emphasises that confidentiality and dignity are closely connected professional obligations.

The Tribunal rejected any suggestion that the conduct amounted to an isolated lapse of judgment.[11] Footnote relvant paragraph in judgement A significant factor was the deliberate and sustained nature of the publication project. The respondent had established a history of medical publishing and intentionally embarked upon the writing of a new book depicting his professional experiences. He then spent an extended period collecting photographs for publication purposes.[12]

These facts distinguished the case from situations involving impulsive or isolated disclosures. The publication required numerous decisions over time: taking photographs, retaining them, selecting material, preparing commentary, producing the manuscript and promoting its sale. The Tribunal considered that the conduct constituted a prolonged course of action rather than a single error.

The respondent’s seniority further heightened the seriousness of the misconduct. As a highly experienced practitioner, mentor and examiner, he was expected to possess a sophisticated understanding of professional obligations. The Tribunal observed that he ought to have appreciated the inappropriateness of the publication well before it was released.[13] Footnote relevant paragraph in judgement

Amazon, Social Media and the Amplification of Risk

Perhaps the most significant aspect of the decision is the Tribunal’s discussion of modern publication technologies. The Tribunal expressly recognised the increasing availability of commercial platforms such as Amazon and the widespread dissemination of content through social media. It emphasised that disclosure of patient information through these avenues, without consent, is fundamentally incompatible with the obligations of a medical practitioner.

These comments reflect an important regulatory concern. Information published online may be rapidly distributed, copied, preserved indefinitely and accessed globally. Unlike traditional forms of communication, digital publication significantly reduces barriers to dissemination. Material capable of reaching only a limited audience in the past can now be made available worldwide almost instantaneously.

The Tribunal therefore treated the publication method as an aggravating consideration. Importantly, the seriousness of the conduct did not depend upon the number of books sold. Only eight copies were purchased through Amazon. Nevertheless, the Tribunal focused on the fact that the material had been intentionally made available to the public at large through a global commercial platform.

The decision has implications extending beyond books. There exists an entire Reddit thread dedicated to discussing this matter[14]. The reasoning applies equally to social media posts, online forums, blogs, podcasts and other forms of digital communication. Health practitioners should view the decision as a reminder that professional obligations remain fully applicable in online environments. Indeed, the potential reach of digital platforms may heighten rather than diminish regulatory concerns.

General Deterrence and Professional Standards 

Although the Tribunal regarded the misconduct as serious, considerable weight was given to the respondent’s response once concerns were raised. He acknowledged that the information was sensitive and confidential, accepted that publication had been unprofessional, offensive and disrespectful, and described himself as “naïve and incredibly foolish” for believing that confidentiality could be maintained simply by obscuring patient details.[15]

Those admissions reflected genuine insight rather than mere acceptance of the factual allegations. The respondent did not attempt to justify his conduct as humorous or harmless. Instead, he accepted responsibility and recognised the ethical and professional shortcomings of his actions.

The respondent also undertook substantial rehabilitative measures. He completed education programs focusing on ethics, professionalism, privacy and confidentiality, participated in mentoring concerning professional obligations and sought medical assistance due to the shame and regret he experienced following the incident.[16] He cooperated fully with investigations and took immediate steps to remove the publication from circulation.

The Tribunal regarded these matters as evidence of genuine rehabilitation and concluded that the need for specific deterrence was therefore reduced. This aspect of the decision demonstrates that insight can be evidenced through practical, tangible actions directed towards demonstrating insight and preventing future repeated conduct.[17]

While the Tribunal accepted that specific deterrence had diminished importance, it emphasised that general deterrence remained a matter of substantial significance.[18] Footnote relevant paragraphs in judgement The decision recognises that disciplinary proceedings serve not only to address the conduct of an individual practitioner but also to communicate professional standards to the wider profession.

The Tribunal expressly rejected submissions that the unusual facts of the case reduced the importance of general deterrence. Instead, it considered it necessary to send a clear message that misuse of confidential patient information through modern publication platforms would attract serious disciplinary consequences. This was particularly important given the increasing accessibility of online publishing and social media.

[47] As to general deterrence, the Tribunal does not accept the submission advanced on behalf of the respondent that the unique factual circumstances of the conduct diminish the weight to be given to that consideration.  General deterrence remains a matter of substantial importance in cases involving the misuse of confidential patient information. As avenues for personal publication continue to expand, including the increasing use of commercial platforms such as Amazon and the widespread dissemination of material through social media, it is necessary to state with clarity that the disclosure of patients’ personal information, by such means, without their consent is fundamentally incompatible with the obligations of a medical practitioner. This applies irrespective of whether the disclosure is motivated by personal gain, by an intention to amuse, or by the sharing of anecdotal “war stories.” Conduct of this kind constitutes a serious departure from professional standards and must attract condign disciplinary sanction, both to mark the gravity of the breach and to deter other practitioners from engaging in similar misuse of confidential patient information.

The reasoning tells us that the purpose of sanctions is to protect the public by addressing risks presented by the conduct while simultaneously maintaining public confidence in the profession through enforcement of professional standards.

The Outcome

Having found professional misconduct, the Tribunal ordered that the respondent be reprimanded and pay a fine of $30,000[19]. No restrictions were imposed upon his registration and no suspension or cancellation order was made.

The outcome is notable given the seriousness of the conduct. The Tribunal had found repeated confidentiality breaches, publication without consent, insensitive commentary and a prolonged course of conduct extending over an extended period. Yet it concluded that more restrictive sanctions were unnecessary because the respondent had demonstrated substantial insight, remorse and rehabilitation.

Health Ombudsman v Rathie is an important contemporary decision concerning patient confidentiality, patient dignity and professional standards in the digital age. The case confirms that confidentiality obligations extend well beyond the removal of names and direct identifiers. Contextual information may permit identification, and de-identification is not a substitute for informed patient consent.

The decision also demonstrates that professional obligations encompass respect, compassion and preservation of patient dignity. Publications that portray patients in a demeaning, insensitive or disrespectful manner may attract disciplinary scrutiny even where confidentiality concerns are not the sole issue.

Perhaps most importantly, the Tribunal’s discussion of Amazon, social media and modern publication technologies signals increasing regulatory concern regarding online dissemination of patient information. The ease with which practitioners can now publish material to global audiences heightens the importance of maintaining rigorous professional standards.

At the same time, Rathie highlights the continuing significance of insight, rehabilitation and cooperation within Australia’s protective disciplinary framework. The respondent’s early admissions, remorse and remedial efforts played a substantial role in shaping the final outcome. The decision therefore serves both as a warning regarding the misuse of patient information and as a demonstration of the practical importance of genuine insight when disciplinary proceedings arise.

Footnotes

[1] Health Ombudsman v Rathie  [1][2026] QCAT 180

[2] Above n0te 1, at  [12]

[3] Above n 1, at [14]

[4] Above n 1, at [17]-[20]

[5] Above n 1, at [22]

[6] Above, n1 at [28]

[7] Above, n1 at [47]

[8] Above, n1 at [41]

[9] Above n 1, At [31]

[10] Above n1, at [31]-[32]

[11] Above n1, at [32]

[12] Above n 1, at [32]

[13] Above n1, at [33]

[14]https://www.reddit.com/r/ausjdocs/comments/1tib9zg/doctor_fined_for_book_of_wtf_surgery_pictures/?rdt=46275

[15] Above n 1, at [21]

[16] Above n 1, at [46]

[17] Above n 1, at [40]

[18] Above n1, at [39]

[19] Above n 1, at [53]