Man Posed as Medical Student to Access Aberdeen Hospital Wards and Confidential Files

A 22-year-old man has admitted to fraud after spending weeks impersonating a medical student at one of Scotland's largest hospitals, gaining access to restricted wards, staff-only areas, and confidential medical files.

Stephen Simpson, from Aberdeen, appeared at Aberdeen Sheriff Court where he pleaded guilty to two amended charges relating to his deception at Aberdeen Royal Infirmary (ARI). The court heard that Simpson wore medical scrubs and NHS-branded clothing while carrying a stethoscope and pager, convincing hospital employees that he was a legitimate medical student authorised to be on the premises.

The fraud took place between 9 December 2023 and 26 January 2024, according to the charge he admitted. Simpson originally faced six separate charges — one of fraud and five of theft — with the fraud allegation initially said to have spanned from 22 September 2023 to 26 January 2024.

His solicitor, Laura Gracie, told the court that Simpson was pleading guilty to two amended charges. The first stated that Simpson pretended to employees at the hospital that he was a medical student who had authorisation to be at ARI. By wearing medical scrubs, NHS-branded clothing, and carrying both a stethoscope and a pager, he induced staff to allow him to remain in the hospital and to gain entry to restricted areas.

The court heard that his deception gave him access to staff-only areas, hospital wards, and medical files — a serious breach of patient privacy and hospital security. He also admitted to stealing items of NHS-branded clothing, a pager, and perfume.

The amended pleas were accepted by fiscal Dylan Middleton, who was representing the Crown in the case. Following the plea, Sheriff Morag McLaughlin deferred sentencing for a criminal justice social work report and a restriction of liberty order assessment. Sentence was deferred until later this month.

The case has raised significant questions about security protocols at Aberdeen Royal Infirmary, which serves as the primary teaching hospital for the north-east of Scotland and handles hundreds of patients daily. The hospital is part of NHS Grampian, the regional health board responsible for healthcare provision across Aberdeen, Aberdeenshire, and Moray.

The fact that Simpson was allegedly able to operate undetected within the hospital for several weeks highlights potential vulnerabilities in how staff verify the credentials of individuals claiming to be medical students or trainees. Medical students typically undergo rigorous identity checks before being granted access to clinical environments, and hospitals are required to maintain strict controls over who can enter patient areas.

Patient confidentiality is a cornerstone of medical ethics and is protected by law in the UK. Unauthorised access to medical files represents a serious breach that could expose sensitive personal health information to individuals with no legitimate reason to view it. The implications for affected patients may include distress, loss of trust in healthcare providers, and potential legal consequences for the health board if adequate safeguards were not in place.

NHS Grampian has been asked for comment regarding the incident and the security breaches that allowed it to occur. The health board has not yet issued a public statement about the case or any measures it may be taking to prevent similar incidents in the future.

The case bears similarities to other incidents across the UK where individuals have gained unauthorised access to healthcare settings by posing as medical professionals or students. Such cases typically prompt reviews of security procedures, including how identification badges are issued and monitored, and how staff are trained to challenge unfamiliar individuals in clinical areas.

The theft charges originally brought against Simpson included items of NHS-branded clothing, a pager, and perfume. The clothing and pager would have been instrumental in helping him blend in with genuine medical staff and students, allowing him to move through the hospital without raising suspicion.

Simpson is due to return to court later this month when sentencing will take place. The criminal justice social work report will provide the court with background information about Simpson's circumstances, while the restriction of liberty order assessment will determine whether he is suitable for a community-based sentence that could include electronic monitoring or curfew requirements.

Sheriff Morag McLaughlin will consider all available options before deciding on an appropriate sentence. The maximum penalty for fraud in Scotland can include imprisonment, although community sentences are also commonly imposed depending on the circumstances and the offender's background.

The case has been reported by BBC Scotland's north east Scotland reporter Ken Banks, who covered the court proceedings in Aberdeen. A previous related article published in May 2025 detailed how Simpson had been accused of posing as a medical student at the hospital for months.

The incident serves as a reminder of the importance of robust security measures in healthcare settings, where vulnerable patients rely on hospitals to protect both their physical safety and their private medical information. Hospital administrators across the country may view this case as an opportunity to review their own access control procedures and ensure that similar breaches cannot occur elsewhere.