Some stories make us immediately ask: “How did the system allow this to happen?” The recent case of a man who admitted pretending to be a medical student at Aberdeen Royal Infirmary is one of them.
Stephen Byres Simpson admitted fraud after posing as a medical student at the hospital between December 2023 and January 2024. According to reporting of the court proceedings, he wore medical scrubs and NHS-branded clothing, carried a stethoscope and pager, used the identity of a real medical student and gained access to staff-only areas, wards and medical files.
The obvious response is to ask why the organisation’s security arrangements didn’t prevent it. That is an important question. But there is another question that interests me even more: How many people saw something they didn’t quite understand and carried on. This isn’t just a story about security. It is a story about human behaviour.
We like to believe systems prevent bad things
Modern organisations are full of controls.
Passes.
Policies.
Training.
CCTV.
Identification systems.
Access restrictions.
Procedures.
We understandably place enormous faith in them. But every system ultimately depends upon people. Someone has to notice something. Someone has to question something. Someone has to say: “Hang on. Who are you?” That isn’t necessarily a dramatic intervention. It might be a ten-second conversation, and that is precisely why active bystandership matters. We often imagine the active bystander as someone witnessing an obvious act of wrongdoing: someone being assaulted, bullied, harassed or threatened. What about security or a threat of terrorism? I shared a post recently that called into question responses to Martyn’s Law in the UK. Martyn Hett was a 29-year-old British man who was killed in the Manchester arena attack in 2017. The legislation is named in his memory.
Martyn’s Law places a responsibility on qualifying venues, including hospitals, to prepare for terrorist attacks. Organisations must have appropriate procedures to reduce harm, with larger venues facing additional protective-security requirements. The emphasis is on preparedness, proportionate action and protecting people.
My fear is that compliance will be the default. More policies, new roles, CCTV, training no the law. What about the human, the members of staff who work in these settings. Compliance doesn’t lead to curiosity. Active Bystandership helps to achieve this.
The Psychology Of Not |Acting
Social psychology has spent decades examining why people don’t intervene. The seminal work of John Darley and Bibb Latané in 1968 demonstrated how the presence of other people can influence whether an individual responds to an emergency. Their research helped establish what became known as the bystander effect. One of the important lessons from this research is that inaction isn’t necessarily about not caring. People can look to others for information about what is happening.
Is this actually a problem?
Does anyone else seem concerned?
Perhaps someone else knows what’s going on.
Maybe I’m misunderstanding the situation.
This matters enormously in organisations, especially in hospitals. Imagine seeing somebody in an area where you don’t recognise them. You notice the scrubs. The stethoscope. The pager. They look as though they belong. Other people appear to accept them. Nothing obviously alarming is happening. Your brain has to make a rapid judgement and the easiest explanation may be: “They must be legitimate.”
That’s not stupidity. It’s how humans navigate uncertain social environments.
We use other people as evidence
This is where the science of social norms becomes particularly interesting. Humans are intensely social creatures. We constantly take cues from those around us about what is normal, acceptable and safe. If everyone else appears comfortable, our own uncertainty can diminish. The absence of challenge becomes a form of social evidence. Nobody is stopping them. Nobody seems concerned. Therefore, perhaps there is nothing to be concerned about.
This is one reason why creating cultures of intervention matters. We need to make checking normal. Not because everyone should walk around suspicious of everyone else. Quite the opposite. A healthy culture allows people to ask reasonable questions without those questions being interpreted as accusations.
There is an enormous difference between: “You’re an impostor.” And “Sorry, I don’t think we’ve met. Which team are you with?” The second is much easier and importantly, it gives the other person an opportunity to respond.
Hierarchy makes this harder
Healthcare provides another important lesson because it is a highly hierarchical environment.
Research into speaking up in healthcare consistently finds that hierarchy, fear of negative responses, uncertainty and concerns about appearing incompetent can inhibit people from raising concerns. Think about that. You see somebody who appears to be more senior than you. You aren’t sure whether they belong there. You consider asking, then you think: “They probably know what they’re doing.”
Or: “I’m only a junior.” Or: “I’ll look stupid if I get this wrong.”v Or perhaps simply: “It’s not really my place.”
These are powerful inhibitors and they don’t only operate in hospitals. They operate in policing. The military, sport, universities, businesses, construction sites and communities.
Anywhere there is hierarchy, and where there are humans, there is the potential for people to defer to others.
In 1961 Stanley Milgram conducted his now infamous electrocution experiment. He proved that authority figures present challenges. In the context of my work, it’s the presence of the authority figure that stops people up.
Psychological safety isn’t about being comfortable
This is where the concept of psychological safety becomes important. Amy Edmondson’s work has helped establish psychological safety as a climate in which people can speak up, ask questions, admit mistakes and raise concerns without fear of interpersonal consequences.
Healthcare safety organisations similarly emphasise psychological safety as essential to enabling staff to raise concerns. I think we sometimes misunderstand the concept. Psychological safety isn’t about making everybody comfortable.
Sometimes speaking up is uncomfortable.
Sometimes asking a question feels awkward.
Sometimes challenging a colleague feels like the last thing you want to do.
The purpose of psychological safety is not to remove that discomfort. It is to make the discomfort manageable. To make people think: “I can ask this question.” and for the person receiving the intervention: “It’s okay that you asked.”
That second part is crucial.
We train the speaker, but what about the receiver?
Research into healthcare speaking-up programmes has increasingly recognised that intervention isn’t simply a skill possessed by the person who speaks. It is a relationship between the person raising the concern and the person receiving it. I advocate a framework that argues specifically for training the receiver mindset, helping people respond constructively when somebody raises a concern rather than becoming defensive or dismissive.
That has enormous implications for active bystandership. We often say: “We need to empower people to speak up.” Yes. But we also need to empower organisations and the people in these organisations to receive the intervention well.
Imagine a nurse asking: “I’m sorry, I don’t recognise you. Can I check which team you’re with?” The answer from the legitimate colleague should not be: “Don’t you know who I am?” It should be: “Of course. I’m working with Professor X today.” If the person isn’t legitimate? The question has potentially interrupted the chain of events. That’s active bystandership.
Prevention isn’t perfection
There is another lesson here. We should be careful about suggesting that active bystandership could definitely have prevented this particular incident. We don’t know. Perhaps someone did ask questions. Perhaps there were controls in place that failed for reasons we don’t yet understand. Perhaps the deception was unusually convincing. We shouldn’t turn one case into a simplistic lesson, but we can use it to ask better questions.
No organisation can eliminate every possibility of deception. No policy can anticipate every behaviour. No security system can remove every vulnerability.
Human beings remain part of the safety system and that means we need to think about the behaviours we want from those human beings.
Make curiosity part of culture
Perhaps one of the simplest things organisations can do is make curiosity an organisational behaviour. Not suspicion. Not confrontation. Curiosity.
Who are you?
What are you doing here?
Who are you working with?
Do you need some help?
I don’t recognise you, can I check?
These aren’t hostile questions. They are protective questions and the more normal they become, the easier they are to ask.
Research into speaking-up behaviour suggests that training can improve confidence and speaking-up behaviours, although the evidence also shows that training alone is insufficient and that organisational culture, hierarchy and psychological safety matter.
That is an important distinction. We shouldn’t simply tell people: “Speak up.” We need to give them the permission, skills and support to do it and we need leaders to model how to receive it.
The Bigger Lesson
For me, the most interesting part of this story isn’t the deception. It’s the assumption that prevention is primarily somebody else’s responsibility. Security’s responsibility.
Management’s responsibility. The compliance team’s responsibility. The person’s responsible for access control But safety is rarely that simple. Sometimes the person who prevents harm is the person who happens to be standing in the corridor.
The receptionist.
The cleaner.
The junior doctor.
The nurse.
The porter.
The administrator.
The security officer.
The colleague who simply thinks: “Something doesn’t quite add up here.” and then does something about it. That is why active bystandership matters. Not because we can guarantee that every harmful event will be prevented. We can’t. More because every organisation has more eyes, ears and opportunities to intervene than its formal leadership structure alone.
The challenge is to turn those people from passive observers into active participants in safety. Sometimes that requires courage. Sometimes it requires skill. Sometimes it requires hierarchy to get out of the way, and sometimes it requires nothing more complicated than giving people permission to ask a question. “Sorry, I don’t think we’ve met. Who are you?” It might feel like a small thing, but cultures that make small interventions normal may be much better placed to catch the big things before they become bigger.
We shouldn’t expect systems to prevent everything. We should build cultures where people help systems work.
