A man who posed as a medical student to gain access to hospital wards and patient files has been ordered to carry out community service.
Stephen Simpson previously admitted carrying out the fraud at Aberdeen Royal Infirmary (ARI) between 9 December 2023 and 26 January 2024.
The 22-year-old accessed the hospital while wearing medical scrubs, NHS branded clothing, a stethoscope and a pager.
At Aberdeen Sheriff Court, Simpson was told to carry out 300 hours of unpaid work. He will also be supervised for two years. He did not comment as he left court.
NHS Grampian has said it has since reviewed its security arrangements "and taken appropriate action".
Sheriff Morag McLaughlin said the seriousness of the offence did pass the custody threshold, but given all the circumstances and sentencing guidelines she was persuaded prison would be "disproportionate".
More stories from North East Scotland, Orkney and Shetland
Listen to news from North East Scotland on BBC Sounds
Simpson originally faced a total of six charges - one of fraud and five of theft.
Last month, he pled guilty to two amended charges.
Simpson, from Aberdeen, admitted that he had pretended to employees that he was a medical student who was authorised to be in the hospital.
He induced staff to allow him to remain in the hospital and gain access to restricted areas and medical files, staff-only areas and wards.
He also admitted stealing items of NHS branded clothing, a pager and perfume.
Sentence had then been deferred.
Procurator fiscal Dylan Middleton, for the Crown, said that on Christmas Day 2023 a security officer received a call from a man stating he was medical student who was in the eye clinic and had found a charity coin-collector machine damaged.
The security officer met Simpson, who was dressed in green scrubs and had a stethoscope round his neck.
He asked who he was and he gave a false name and said he was there studying. He was allowed to continue, and the incident was documented.
On 27 December, staff returned from the festive break and two people found their lockers had been rummaged through. Perfume was missing from one, and NHS clothing had gone from another.
Security were alerted, the Christmas Day incident was raised, and police were contacted.
The head of security began reviewing CCTV footage, and multiple incidents of medical notes being handed to staff by the accused were seen.
He was also seen leaving a lift with documents in his hand and taking a selfie on a mobile phone, before handing the notes to staff.
His image was shared with security staff to raise awareness due to concerns he was not a member of staff.
In the early hours of 26 January 2024, security officers spotted him dressed in green scrubs, an NHS fleece, with a stethoscope and an NHS pager.
He was stopped and questioned about his credentials and why he was there, and checks confirmed he was not a staff member, so police were contacted.
The pager, which had belonged to a consultant surgeon, was deactivated.
Police inquiries into Simpson's background showed he had been studying access to nursing, but that did not include placements or access to NHS equipment.
Simpson's lawyer Laura Gracie said there was no suggestion he had actually done anything with the patient files in question.
Gracie said Simpson had been interested in a career in nursing, adding: "Unfortunately that has all blown up."
She added that Simpson was "absolutely embarrassed", but accepted he had brought it on himself.
'Lessons to reflect on'
Sheriff McLaughlin said she considered it to be a serious and potentially dangerous offence, with a "violation of privacy" involving sensitive information.
However, she said the offences were almost three years ago, and balancing all the factors before her, the sentence would be a community payback order.
A spokesperson for NHS Grampian said after the sentencing: "We understand the concern that this will cause our patients, staff and the wider public.
"Since this came to light, we have reviewed our security arrangements and taken appropriate action. It is important to note this individual had no face-to-face patient contact and never accessed our IT systems.
"We reported ourselves to the Information Commissioner's Office in relation to this case and it concluded no further action was required."
