Woman fined for illegally accessing patient records while working at NUH
Christine Tan
The Straits Times
Dec 1, 2025
While working as a customer service associate at National University Hospital (NUH), a woman accessed the information of 11 patients without authorisation.
Norkamelia Osman, 34, was fined $5,000 on Dec 1 after she pleaded guilty to one offence under the Computer Misuse Act, with a similar charge taken into consideration for her sentencing.
The court heard that Norkamelia was a customer service associate at Ng Teng Fong General Hospital from June 2018, and was later deployed to NUH in September 2022.
Her job role meant she had access to the Epic system, which enables healthcare institutions to maintain patient records and schedule appointments, among other business processes.
The system contains records of patients' personal identification information, medical appointments and billing information.
Norkamelia was not authorised to access records of patients who did not fall within her purview.
In July 2023, NUH received an anonymous tip-off from a woman who worked at an unnamed medical institution.
The woman said Norkamelia had reached out to her on Instagram and the two began talking via WhatsApp.
Norkamelia asked about the woman's employment and child's health particulars, and the latter was taken aback as she had not disclosed such confidential information.
When the woman asked Norkamelia how she had the information, Norkamelia said she had access to it at her workplace.
Deputy Public Prosecutor (DPP) Sivaranjini Pillai Eliathamby said the woman was disconcerted by Norkamelia's actions and filed the tip-off.
The Ministry of Health (MOH) then conducted internal investigations. An MOH employee made a police report in May 2024 notifying the authorities about the outcome of the ministry's review.
Norkamelia admitted to the police that she and the woman had lost touch during the Covid-19 pandemic, and she had accessed the woman's and her child's records on the Epic system as she desired to "reignite a relationship" with her, said DPP Sivaranjini.
Between July 1, 2022, and Dec 31, 2022, Norkamelia accessed the Epic system 223 times to review the records of 11 patients not under her care. These included herself, her husband, son, brother-in-law, former boss and several ex-colleagues.
Calling for the maximum fine of $5,000, DPP Sivaranjini said Norkamelia exploited her position and breached the trust reposed in her.
But the prosecutor accepted that Norkamelia appears remorseful, cooperated during investigations and is a first-time offender.
District Judge Tan Jen Tse told Norkamelia that the prosecution was being fair and kind to her.
