Man Admits Posing as Medical Student to Access Aberdeen Hospital Wards and Confidential Files

A 22-year-old man has pleaded guilty to fraud after spending several weeks masquerading as a medical student at one of Scotland's largest hospitals, gaining access to restricted wards, staff-only areas, and confidential medical files. Stephen Simpson, from Aberdeen, admitted the deception when he appeared at Aberdeen Sheriff Court, in a case that has raised uncomfortable questions about security and identity verification at NHS facilities.

Simpson wore medical scrubs and NHS-branded clothing during his time at Aberdeen Royal Infirmary (ARI), and carried both a stethoscope and a pager to complete the carefully constructed impression that he was a genuine member of clinical staff. According to the charges accepted by the court, he induced hospital employees to believe he was a medical student who was authorised to be inside the building, allowing him to move freely through areas normally reserved for qualified personnel.

The fraud is said to have spanned a period of several weeks, with the court hearing that the conduct took place between 9 December 2023 and 26 January 2024. Prosecutors originally alleged that the offending stretched back even further, to 22 September 2023, although that earlier timeframe was not ultimately accepted as part of the amended charges.

Simpson had initially faced a total of six charges — one of fraud and five separate allegations of theft. However, his solicitor, Laura Gracie, told the court that her client was pleading guilty to two amended charges, a development that narrowed the scope of the case considerably. The amended pleas were accepted by fiscal Dylan Middleton, who was representing the Crown.

The first amended charge relates to Simpson pretending to employees at ARI that he was a medical student with the authority to be on the premises. The second concerns the theft of a number of items, including NHS-branded clothing, a pager, and perfume. The combination of the two charges paints a picture of a sustained and deliberate effort to embed himself within the hospital environment.

Beyond simply being present in the building, the court was told that Simpson's deception allowed him to access restricted areas and files, including staff-only zones, wards, and medical records. That access is likely to be the most serious element of the case from the perspective of hospital authorities, given the strict confidentiality rules that govern patient information and the potential consequences of unauthorised individuals viewing sensitive material.

The case has prompted questions about how an outsider was able to maintain such a convincing cover for what appears to have been a considerable length of time. Hospitals operate on a principle of trust, with staff often relying on visual cues such as uniforms and identification to determine whether someone belongs in a given area. Simpson appears to have exploited that trust by adopting the outward trappings of a clinical role.

Sheriff Morag McLaughlin deferred sentence following the guilty pleas, calling for a criminal justice social work report and an assessment for a restriction of liberty order. That assessment suggests the court is considering whether a community-based disposal, potentially involving an electronic tag or curfew, might be appropriate in this case rather than a custodial sentence.

A restriction of liberty order in Scotland is a community sentence that requires an offender to remain within a specified address during certain hours, typically enforced by electronic monitoring. The decision to seek such an assessment indicates that the sheriff wishes to explore all available options before determining the appropriate punishment for Simpson.

Sentence was deferred until later this month, meaning Simpson will return to court to learn his fate once the background reports have been prepared. NHS Grampian, the health board responsible for Aberdeen Royal Infirmary, has been approached for comment regarding the incident.

The case has echoes of previous incidents in which individuals have gained unauthorised access to hospital premises by posing as staff. Such episodes tend to prompt reviews of security protocols, particularly around the issuing and checking of identification badges, the monitoring of restricted areas, and the challenge culture among employees when they encounter unfamiliar faces.

Aberdeen Royal Infirmary is one of the principal teaching hospitals in the north of Scotland and serves a wide catchment area across Grampian and beyond. It hosts a large number of medical students on placement at any given time, which may complicate efforts to verify the status of every individual moving through its corridors. That context could be relevant as authorities consider how the breach occurred.

Medical records are protected under strict data protection legislation, and unauthorised access to patient information can constitute a serious offence in its own right. The fact that Simpson was able to reach files during his time at the hospital may therefore have implications beyond the fraud charge itself, even though no additional charges relating to data protection were brought in this instance.

The fraud charge admitted by Simpson covers the period from early December 2023 to late January 2024, a span of roughly seven weeks during which he allegedly presented himself as a medical student. The theft charge relates to items he took from the hospital, including the NHS-branded clothing and pager that formed part of his disguise, as well as perfume.

Simpson, who is from the Aberdeen area, will be sentenced later this month once the reports have been completed. Until then, he remains subject to the court's discretion, with the sheriff having indicated that both a community-based sentence and a more restrictive order are among the possibilities being considered.

The case serves as a reminder of the importance of robust identity checks and staff vigilance in large public institutions, particularly those handling sensitive personal data. It also highlights the potential for relatively simple deceptions — a uniform, a stethoscope, and an air of confidence — to bypass safeguards that are designed to protect both patients and the integrity of healthcare records.