Privacy campaigners have urged north and north-east health boards to take patient confidentiality more seriously after it emerged that staff have been sacked over the issue.
Civil liberties group Big Brother Watch said it was “completely unacceptable” that NHS workers in Grampian, Highland, Orkney and Shetland broke data protection laws on 60 occasions between 2011 and 2014.
Research published today showed there were 23 incidents involving NHS Grampian workers.
Two non-medical staff were dismissed for accessing an IT system using a colleague’s login and another person was fired for accessing patient information.
Two medical workers were given disciplinary warnings for disposing of clinical information and accessing patient information inappropriately.
Figures released by the health board under freedom of information laws showed 12 non-medical workers were given disciplinary warnings.
One non-medical member of staff was suspended for sharing patient information with a third party.
No one who works for NHS Grampian has been convicted of breaking data protection laws, a situation mirrored in Orkney, where there were 30 incidents between 2011 and 2014.
There were three cases in Shetland and four involving staff in Highland.
The figures showed there were 634 data breaches across the NHS in Scotland over the period, with the worst offender being NHS Borders, which dealt with 180 incidents.
Big Brother Watch director Emma Carr said: “The information held in medical records is of huge personal significance and for details to be wrongly disclosed, maliciously accessed or lost is completely unacceptable.”
North East Labour MSP Richard Baker said any breach of patient trust was “wholly unacceptable”.
“While NHS Grampian has one of the lower rates of patient-confidentiality breaches, there have been dismissals, which shows how serious a matter this is,” he added.
A spokeswoman for NHS Grampian said data protection was taken “very seriously”.
She added that while it was disappointing that there had been 23 breaches, the issue must be seen in the context of the millions of occasions patient data was handled every year.