Corporate trends / Performance record
Unfair Dismissal Case on “Appropriateness of Disciplinary Sanction (Unauthorized Access to Electronic Medical Records)” (Unfair Dismissal 408)
- Date2026/04/27 04:08
- Read 147
[Case Information]
This case is a decision in which the employer prevailed (application dismissed) on the issue of “appropriateness of disciplinary sanction (unauthorized access to electronic medical records).”
Adjudicating body: Busan Regional Labor Relations Commission
Case: 2025Buhae9170 ○ ○ ○ Application for Remedy for Unfair Dismissal
Decision date: 2026.02.11 · Outcome: Dismissed
Summary of key issues:
A. Whether grounds for discipline existed: It was confirmed through Employer’s Exhibit No. 8-1 (case inquiry), Union’s Exhibit No. 6 (statement), etc. that the employee, on or about September 1, 8, 19, 22, 24, and 25, 2025, used another employee’s ID and password without authorization on approximately 10 occasions in total to access and view, without permission, the hospital’s computerized systems including electronic medical records (the “misconduct”). The employee did not deny the misconduct. Accordingly, the discipli…
1. Legal Implications
Ⅰ. Case Overview
In this case, an employee who had worked at a hospital for more than 10 years was dismissed for cause after repeatedly accessing and viewing, without authorization, the hospital’s computerized systems, including electronic medical records, by using another employee’s ID and password. The employee filed an application with the Labor Relations Commission seeking a remedy for unfair dismissal.
The Busan Regional Labor Relations Commission examined the case focusing on (i) the existence of grounds for discipline, (ii) the appropriateness of the level of disciplinary sanction, and (iii) the lawfulness of the disciplinary procedures. It ultimately dismissed the employee’s application.
Ⅱ. Summary of Issues
The issue in this case was:
“Where an employee has repeatedly and without authorization accessed and viewed electronic medical records and other highly sensitive personal information, whether dismissal—the most severe disciplinary measure—constitutes an appropriate level of disciplinary sanction under generally accepted social norms.”
Ⅲ. Summary of the Labor Relations Commission’s Reasoning
The adjudicating panel found that the employee had, on multiple occasions, accessed and viewed the electronic medical record system without authorization by using another employee’s account; that, having worked at the hospital for over 10 years, the employee was in a position where he or she should have set an example for others, yet nevertheless intentionally engaged in misconduct to resolve a personal dispute; that the employee had even received a summary criminal disposition of a KRW 5 million fine as a result of the misconduct; and that the level of disciplinary sanction is, in principle, within the discretionary authority of the disciplinary decision-maker.
In light of the above, the panel held that the dismissal in this case fell within the category of situations where, under generally accepted social norms, there exists a reason attributable to the employee such that continuation of the employment relationship cannot reasonably be expected. Accordingly, it was difficult to view the dismissal as a departure from or abuse of the employer’s discretionary authority in imposing discipline.
The Commission further noted that a disciplinary committee had been convened, the employee had been given an opportunity to explain, and notice of the disposition had been provided, and that there was no particular dispute between the parties regarding the procedures. It therefore found no procedural defects.
Ⅳ. Practical Points (From the Employee’s Perspective)
From the employee’s perspective, it must be borne in mind that information stored in medical institutions’ computerized systems, such as electronic medical records, constitutes highly sensitive personal data, and that even a single instance of unauthorized access using another person’s account can be evaluated as serious misconduct.
In particular, in sectors with a strong public-interest character—such as hospitals and financial institutions—acts that infringe personal information or undermine trust may lead directly to dismissal, even where the employee has long service or a good performance record. Employees should exercise particular caution in this regard.
Ⅴ. Practical Points (From the Employer’s (Company’s) Perspective)
From the employer’s perspective, it is advisable to clearly stipulate in the rules of employment and HR regulations that violations of personal data protection obligations and unauthorized access to computerized systems constitute explicit grounds for discipline, and to specify in detail the level of sanctions and criteria for assessment in the event of such violations.
Furthermore, when opting for dismissal as a disciplinary measure, employers should comprehensively review and record in the disciplinary resolution and notice the number of instances of misconduct, the degree of intent, the employee’s duties and position, and whether any criminal penalties have been imposed. This preparation is necessary to ensure that, before the Labor Relations Commission or the courts, the disciplinary measure is not found to constitute an abuse of discretionary authority.
Labor Law Firm Law& establishes systematic response strategies from the Labor Relations Commission stage onward in disputes concerning unfair dismissal, collective redundancies, and the appropriateness of disciplinary sanctions, based on the legal principles illustrated above.
2. Matters Adjudicated
A. Case Overview and Procedural History
A. Whether grounds for discipline existed
It was confirmed through Employer’s Exhibit No. 8-1 (case inquiry), Union’s Exhibit No. 6 (statement), etc. that the employee, on or about September 1, 8, 19, 22, 24, and 25, 2025, used another employee’s ID and password without authorization on approximately 10 occasions in total to access and view, without permission, the hospital’s computerized systems including electronic medical records (the “misconduct”). The employee did not deny the misconduct. Accordingly, grounds for discipline existed.
B. Whether the level of disciplinary sanction was appropriate
The employee had worked at the hospital for more than 10 years and was therefore in a position where he or she should have set an example for others. Nevertheless, in order to verify matters relating to a personal dispute, the employee intentionally used another employee’s account to access the electronic medical record system and view the personal information of hospital staff and patients. As a result of Misconduct 1, the employee received a summary criminal disposition of a KRW 5 million fine. Considering that the level of disciplinary sanction is, in principle, an area in which the disciplinary authority is granted discretion, it can be recognized that, under generally accepted social norms, there exists a reason attributable to the employee such that continuation of the employment relationship cannot reasonably be expected. Therefore, it is difficult to view the dismissal as a departure from or abuse of discretionary authority in determining the level of disciplinary sanction.
C. Whether the disciplinary procedures were lawful
There is no dispute between the parties regarding the disciplinary procedures, and the procedures such as convening the disciplinary committee, providing an opportunity to explain, and giving notice of the disposition were all carried out. Accordingly, there were no defects.
3. Summary of the Decision
A. Summary of the Labor Relations Commission’s Reasoning
A. Whether grounds for discipline existed
It was confirmed through Employer’s Exhibit No. 8-1 (case inquiry), Union’s Exhibit No. 6 (statement), etc. that the employee, on or about September 1, 8, 19, 22, 24, and 25, 2025, used another employee’s ID and password without authorization on approximately 10 occasions in total to access and view, without permission, the hospital’s computerized systems including electronic medical records (the “misconduct”). The employee did not deny the misconduct. Accordingly, grounds for discipline existed.
B. Whether the level of disciplinary sanction was appropriate
The employee had worked at the hospital for more than 10 years and was therefore in a position where he or she should have set an example for others. Nevertheless, in order to verify matters relating to a personal dispute, the employee intentionally used another employee’s account to access the electronic medical record system and view the personal information of hospital staff and patients. As a result of Misconduct 1, the employee received a summary criminal disposition of a KRW 5 million fine. Considering that the level of disciplinary sanction is, in principle, an area in which the disciplinary authority is granted discretion, it can be recognized that, under generally accepted social norms, there exists a reason attributable to the employee such that continuation of the employment relationship cannot reasonably be expected. Therefore, it is difficult to view the dismissal as a departure from or abuse of discretionary authority in determining the level of disciplinary sanction.
C. Whether the disciplinary procedures were lawful
There is no dispute between the parties regarding the disciplinary procedures, and the procedures such as convening the disciplinary committee, providing an opportunity to explain, and giving notice of the disposition were all carried out. Accordingly, there were no defects.
/
[See More Related Decisions]
- “‘No Formation of Hiring Commitment (Absence of Offer Letter)’ Unfair Dismissal Decision” – Decision date: – Case number: First-instance decision upheld
- “‘Non-Existence of Expectation of Renewal (Dual Contracts for 15 Hours per Week and 40 Hours per Week)’ Unfair Dismissal Decision”
- “‘Dismissal (Non-Appearance at Hearing)’ Unfair Dismissal Decision” – Decision date: – Case number: Dismissed
[Tags]
Unfair dismissal, appropriateness of disciplinary sanction (unauthorized access to electronic medical records), disciplinary dismissal, violation of company policy · non-compliance with work instructions, Labor Law Firm Law&, large labor law firm, Samseong-dong labor law firm, Samseong Station labor law firm, Gangnam labor law firm
※ This article is part of Labor Law Firm Law&’s “Unfair Dismissal Decisions” series.
※ You can view the previous article, “‘Non-Existence of Expectation of Renewal (Dual Contracts for 15 Hours per Week and 40 Hours per Week)’ Unfair Dismissal Decision,” in a new window.
※ The list of decisions related to appropriateness of disciplinary sanction (unauthorized access to electronic medical records) can be viewed together at “List of Decisions on Appropriateness of Disciplinary Sanction (Unauthorized Access to Electronic Medical Records).”
※ Korean version of this case: Korean article
This case is a decision in which the employer prevailed (application dismissed) on the issue of “appropriateness of disciplinary sanction (unauthorized access to electronic medical records).”
Adjudicating body: Busan Regional Labor Relations Commission
Case: 2025Buhae9170 ○ ○ ○ Application for Remedy for Unfair Dismissal
Decision date: 2026.02.11 · Outcome: Dismissed
Summary of key issues:
A. Whether grounds for discipline existed: It was confirmed through Employer’s Exhibit No. 8-1 (case inquiry), Union’s Exhibit No. 6 (statement), etc. that the employee, on or about September 1, 8, 19, 22, 24, and 25, 2025, used another employee’s ID and password without authorization on approximately 10 occasions in total to access and view, without permission, the hospital’s computerized systems including electronic medical records (the “misconduct”). The employee did not deny the misconduct. Accordingly, the discipli…
1. Legal Implications
Ⅰ. Case Overview
In this case, an employee who had worked at a hospital for more than 10 years was dismissed for cause after repeatedly accessing and viewing, without authorization, the hospital’s computerized systems, including electronic medical records, by using another employee’s ID and password. The employee filed an application with the Labor Relations Commission seeking a remedy for unfair dismissal.
The Busan Regional Labor Relations Commission examined the case focusing on (i) the existence of grounds for discipline, (ii) the appropriateness of the level of disciplinary sanction, and (iii) the lawfulness of the disciplinary procedures. It ultimately dismissed the employee’s application.
Ⅱ. Summary of Issues
The issue in this case was:
“Where an employee has repeatedly and without authorization accessed and viewed electronic medical records and other highly sensitive personal information, whether dismissal—the most severe disciplinary measure—constitutes an appropriate level of disciplinary sanction under generally accepted social norms.”
Ⅲ. Summary of the Labor Relations Commission’s Reasoning
The adjudicating panel found that the employee had, on multiple occasions, accessed and viewed the electronic medical record system without authorization by using another employee’s account; that, having worked at the hospital for over 10 years, the employee was in a position where he or she should have set an example for others, yet nevertheless intentionally engaged in misconduct to resolve a personal dispute; that the employee had even received a summary criminal disposition of a KRW 5 million fine as a result of the misconduct; and that the level of disciplinary sanction is, in principle, within the discretionary authority of the disciplinary decision-maker.
In light of the above, the panel held that the dismissal in this case fell within the category of situations where, under generally accepted social norms, there exists a reason attributable to the employee such that continuation of the employment relationship cannot reasonably be expected. Accordingly, it was difficult to view the dismissal as a departure from or abuse of the employer’s discretionary authority in imposing discipline.
The Commission further noted that a disciplinary committee had been convened, the employee had been given an opportunity to explain, and notice of the disposition had been provided, and that there was no particular dispute between the parties regarding the procedures. It therefore found no procedural defects.
Ⅳ. Practical Points (From the Employee’s Perspective)
From the employee’s perspective, it must be borne in mind that information stored in medical institutions’ computerized systems, such as electronic medical records, constitutes highly sensitive personal data, and that even a single instance of unauthorized access using another person’s account can be evaluated as serious misconduct.
In particular, in sectors with a strong public-interest character—such as hospitals and financial institutions—acts that infringe personal information or undermine trust may lead directly to dismissal, even where the employee has long service or a good performance record. Employees should exercise particular caution in this regard.
Ⅴ. Practical Points (From the Employer’s (Company’s) Perspective)
From the employer’s perspective, it is advisable to clearly stipulate in the rules of employment and HR regulations that violations of personal data protection obligations and unauthorized access to computerized systems constitute explicit grounds for discipline, and to specify in detail the level of sanctions and criteria for assessment in the event of such violations.
Furthermore, when opting for dismissal as a disciplinary measure, employers should comprehensively review and record in the disciplinary resolution and notice the number of instances of misconduct, the degree of intent, the employee’s duties and position, and whether any criminal penalties have been imposed. This preparation is necessary to ensure that, before the Labor Relations Commission or the courts, the disciplinary measure is not found to constitute an abuse of discretionary authority.
Labor Law Firm Law& establishes systematic response strategies from the Labor Relations Commission stage onward in disputes concerning unfair dismissal, collective redundancies, and the appropriateness of disciplinary sanctions, based on the legal principles illustrated above.
2. Matters Adjudicated
A. Case Overview and Procedural History
A. Whether grounds for discipline existed
It was confirmed through Employer’s Exhibit No. 8-1 (case inquiry), Union’s Exhibit No. 6 (statement), etc. that the employee, on or about September 1, 8, 19, 22, 24, and 25, 2025, used another employee’s ID and password without authorization on approximately 10 occasions in total to access and view, without permission, the hospital’s computerized systems including electronic medical records (the “misconduct”). The employee did not deny the misconduct. Accordingly, grounds for discipline existed.
B. Whether the level of disciplinary sanction was appropriate
The employee had worked at the hospital for more than 10 years and was therefore in a position where he or she should have set an example for others. Nevertheless, in order to verify matters relating to a personal dispute, the employee intentionally used another employee’s account to access the electronic medical record system and view the personal information of hospital staff and patients. As a result of Misconduct 1, the employee received a summary criminal disposition of a KRW 5 million fine. Considering that the level of disciplinary sanction is, in principle, an area in which the disciplinary authority is granted discretion, it can be recognized that, under generally accepted social norms, there exists a reason attributable to the employee such that continuation of the employment relationship cannot reasonably be expected. Therefore, it is difficult to view the dismissal as a departure from or abuse of discretionary authority in determining the level of disciplinary sanction.
C. Whether the disciplinary procedures were lawful
There is no dispute between the parties regarding the disciplinary procedures, and the procedures such as convening the disciplinary committee, providing an opportunity to explain, and giving notice of the disposition were all carried out. Accordingly, there were no defects.
3. Summary of the Decision
A. Summary of the Labor Relations Commission’s Reasoning
A. Whether grounds for discipline existed
It was confirmed through Employer’s Exhibit No. 8-1 (case inquiry), Union’s Exhibit No. 6 (statement), etc. that the employee, on or about September 1, 8, 19, 22, 24, and 25, 2025, used another employee’s ID and password without authorization on approximately 10 occasions in total to access and view, without permission, the hospital’s computerized systems including electronic medical records (the “misconduct”). The employee did not deny the misconduct. Accordingly, grounds for discipline existed.
B. Whether the level of disciplinary sanction was appropriate
The employee had worked at the hospital for more than 10 years and was therefore in a position where he or she should have set an example for others. Nevertheless, in order to verify matters relating to a personal dispute, the employee intentionally used another employee’s account to access the electronic medical record system and view the personal information of hospital staff and patients. As a result of Misconduct 1, the employee received a summary criminal disposition of a KRW 5 million fine. Considering that the level of disciplinary sanction is, in principle, an area in which the disciplinary authority is granted discretion, it can be recognized that, under generally accepted social norms, there exists a reason attributable to the employee such that continuation of the employment relationship cannot reasonably be expected. Therefore, it is difficult to view the dismissal as a departure from or abuse of discretionary authority in determining the level of disciplinary sanction.
C. Whether the disciplinary procedures were lawful
There is no dispute between the parties regarding the disciplinary procedures, and the procedures such as convening the disciplinary committee, providing an opportunity to explain, and giving notice of the disposition were all carried out. Accordingly, there were no defects.
/
[See More Related Decisions]
- “‘No Formation of Hiring Commitment (Absence of Offer Letter)’ Unfair Dismissal Decision” – Decision date: – Case number: First-instance decision upheld
- “‘Non-Existence of Expectation of Renewal (Dual Contracts for 15 Hours per Week and 40 Hours per Week)’ Unfair Dismissal Decision”
- “‘Dismissal (Non-Appearance at Hearing)’ Unfair Dismissal Decision” – Decision date: – Case number: Dismissed
[Tags]
Unfair dismissal, appropriateness of disciplinary sanction (unauthorized access to electronic medical records), disciplinary dismissal, violation of company policy · non-compliance with work instructions, Labor Law Firm Law&, large labor law firm, Samseong-dong labor law firm, Samseong Station labor law firm, Gangnam labor law firm
※ This article is part of Labor Law Firm Law&’s “Unfair Dismissal Decisions” series.
※ You can view the previous article, “‘Non-Existence of Expectation of Renewal (Dual Contracts for 15 Hours per Week and 40 Hours per Week)’ Unfair Dismissal Decision,” in a new window.
※ The list of decisions related to appropriateness of disciplinary sanction (unauthorized access to electronic medical records) can be viewed together at “List of Decisions on Appropriateness of Disciplinary Sanction (Unauthorized Access to Electronic Medical Records).”
※ Korean version of this case: Korean article
