VANDE WALLE, Justice.

Darlene Tehven appealed from a district court judgment affirming Job Service North Dakota's denial of her request for unemployment compensation benefits. We affirm.

Tehven was a clerk in the medical records department of St. Luke's Hospital for 8 1/2 years. The Hospital had a general confidentiality policy for patient medical records. The Hospital also had a policy allowing a medical records employee or relative to have his or her medical records locked in the medical records supervisor's desk so that other medical records employees would not have access to them. Tehven's husband had requested that his records be locked in the records supervisor's desk, and Tehven did not have his permission to have access to them.

While working the night shift on December 20, 1990, Tehven was purging records, which involved taking records out of old files so the records could be stored. Tehven discovered her husband's "lab" and summary sheet, which had been misfiled about two years previously, when Tehven's husband was a hospital patient. Tehven put the "lab" in her lunch sack in the bottom drawer of her desk, where it was discovered by a co-worker, who put it in an envelope and gave it to the records supervisor the next day. After noticing that the records had been removed from her desk, Tehven did not discuss the matter with anyone or report it to her supervisor. Tehven was fired for breach of confidentiality on January 3, 1991.

Job Service initially determined that Tehven was entitled to unemployment benefits. The Hospital appealed. After a telephone hearing, the appeals referee found, among other things, that Tehven was discharged "for breach of security" and issued the following "REASON FOR THE DECISION":

"The claimant breached a very significant security rule when she removed the file and did not immediately place it into the custody of her supervisor. It must be reasoned that her intent was not proper when she failed to notify her supervisor that the files were missing from her desk drawer. Under the circumstances, it must be ruled that she improperly took possession of the file which was a serious breach of company security. This must be ruled misconduct for the purposes of unemployment insurance benefits."

The referee's decision determined that Tehven was disqualified from benefits under § 52-06-02(2), N.D.C.C., because Tehven was discharged for misconduct. Job Service affirmed the referee's decision and the district court affirmed. Tehven has raised the following issues on appeal: (1) Were the findings of fact supported by a preponderance of the evidence, the conclusions of law sustained by the findings, and the decision supported by the conclusions; and (2) Did Tehven's conduct constitute misconduct?

In reviewing the factual basis of an administrative agency decision, we do not make independent findings of fact or substitute our judgment for that of the agency. Marion v. Job Service North Dakota, 470 N.W.2d 609 (N.D. 1991). "We determine only whether a reasoning mind reasonably could have determined that the factual conclusions reached were proved by the weight of the evidence from the entire record." Power Fuels, Inc. v. Elkin, 283 N.W.2d 214, 220 (N.D. 1979). Whether or not a person's actions constitute misconduct precluding eligibility for unemployment compensation benefits involves a mixed question of fact and law. Marion v. Job Service North Dakota, supra. For Job Service's decision to be upheld on appeal, the evidence must support its findings of fact, which must sustain its conclusion of misconduct. Id.

The referee's findings of fact and conclusions of law are sparse and poorly drafted. They "are not examples to be followed for compliance" with § 28-32-13, N.D.C.C., requiring the agency to "make and state concisely and explicitly its findings of fact. . . ." Walter v. North Dakota State Highway Comm'r, 391 N.W.2d 155, 157 (N.D. 1986). The findings are adequate, however, because "they enable a reviewing court to understand the basis of the agency's decision." F.O.E. Aerie 2337 v. North Dakota Workers Compensation Bureau, 464 N.W.2d 197, 199-200 (N.D. 1990).

Tehven contends that the following finding of fact is not supported by a preponderance of the evidence: "After the supervisor investigated the incident she discharged the claimant for breach of security." Tehven argues: "A preponderance of the evidence clearly shows Darlene was, in fact, discharged for a `breach of confidentiality' not for a `breach of security'." (Emphasis by Tehven.) Confidentiality and security are both terms dealing with the concept of limiting access or disclosure. The Hospital had a policy of maintaining secrecy of the contents of patient medical records. Only authorized persons were to have access to the information contained in them. An unauthorized person's access to the information in a patient's medical records is a violation of the Hospital's policy, whether it be termed a breach of security or a breach of confidentiality. The finding is supported by a preponderance of the evidence.

Tehven argues that she "was fired for a breach of confidentiality . . . [but] there was no breach of confidentiality because Darlene Tehven never revealed the confidential information to anyone." (Emphasis by Tehven.) We disagree. Tehven was not supposed to have access to her husband's medical records. By taking possession of her husband's medical records and retaining her access to the information contained in them, Tehven violated the Hospital's policy of confidentiality with regard to medical records. Disclosure to someone else of medical records wrongfully obtained is unnecessary to constitute a violation of the Hospital's policy of confidentiality.

The findings of Job Service, while unnecessarily conclusory, indicate that Tehven's intent "was not proper when she failed to notify her supervisor that the files were missing from her desk drawer." The testimony at the agency hearing reveals Tehven and her husband were in the process of a divorce. Tehven's explanation for placing the records in her lunch sack in the bottom drawer of her desk rather than leaving them where they were found and reporting to the records supervisor and subsequently failing to inform the supervisor when she discovered the records had been removed from her desk drawer, was that Tehven did not want anyone to know that her husband had been in the hospital and that she would be embarrassed to have people learn he had been in the hospital. Nevertheless, the agency, the trier of fact, could draw adverse inferences from the fact Tehven failed to bring the matter to the attention of the records supervisor until she was confronted by the supervisor nearly two weeks later. Thus the inference may be drawn that it was more than mere embarrassment which prompted Tehven to remove the records and fail to report the matter when she found the records missing from her desk.

Tehven asserts that "she may not have had actual `access' to the patient information because she could not even understand the specifics of what was in her husband's records." However, the extent to which Tehven might understand or be able to use the information to which she had gained unauthorized access is irrelevant. The Hospital's confidentiality policy was violated when Tehven wrongfully retained her husband's records, regardless of whether she understood the information contained in them.

We conclude from our review of the record that a reasoning mind reasonably could have determined that the factual conclusions reached by the agency were proved by the weight of the evidence. We, therefore, conclude that the agency's findings of fact are supported by a preponderance of the evidence.

Tehven contends that Job Service's conclusions of law are not sustained by its findings of fact. More specifically, Tehven contends that her conduct did not constitute misconduct disqualifying her from receiving unemployment compensation benefits. We disagree.

In Perske v. Job Service North Dakota, 336 N.W.2d 146, 148-49 (N.D. 1983), this court adopted the definition of misconduct enunciated by the Wisconsin Supreme Court in Boynton Cab Co. v. Neubeck, 237 Wis. 249, 296 N.W. 636, 640 (1941):

"`. . . conduct evincing such wilful or wanton disregard of an employer's interests as is found in deliberate violations or disregard of standards of behavior which the employer has the right to expect of his employee, or in carelessness or negligence of such degree or recurrence as to manifest equal culpability, wrongful intent or evil design, or to show an intentional and substantial disregard of the employer's interests or of the employee's duties and obligations to his employer. On the other hand mere inefficiency, unsatisfactory conduct, failure in good performance as the result of inability or incapacity, inadvertencies or ordinary negligence in isolated instances, or good faith errors in judgment or discretion are not to be deemed "misconduct" within the meaning of the statute.'"

Generally, a physician may not disclose medical information acquired in treating a patient. The importance of physician-patient confidentiality is recognized in § 43-17-31(13), N.D.C.C., which provides that disciplinary action may be imposed upon a physician for "willful or negligent violation of the confidentiality between physician and patient." Courts have generally recognized a patient's right to recover damages from a physician for unauthorized disclosure of medical information as an invasion of privacy, a breach of the physician-patient confidential relationship, a violation of statute, or breach of the fiduciary relationship between a physician and a patient. Anno., Physician's tort liability for unauthorized disclosure of confidential information about patient, 48 A.L.R. 4th 668 (1986); 32 Am.Jur.Trials pp. 113-177 (1985). The patient's privilege against disclosure of medical information generally extends to hospital records. Anno., Physician-patient privilege as extending to patient's medical or hospital records, 10 A.L.R. 4th 552 (1981). Thus, a hospital has a very important interest in maintaining the confidentiality of patients' hospital medical records to avoid liability for unauthorized disclosure of patient medical information.

Testimony by its employment manager illustrates the importance that the Hospital attached to confidentiality:

"[T]he employees of the hospital are very aware of confidentiality issues, that they do know that any breach can result in termination. We deal with extremely confidential information on a, on a consistent basis and therefore we do stress that in our policy manual. The medical records department has the individual employees sign a form each year that addresses confidentiality and the fact that they can be terminated if there is a breach. They also have an attorney come in every two years and talk with the department about those kinds of issues. And our contention is that this, that [Tehven] knew or should have known the consequences of the breach of con — confidentiality that did exist."

Tehven argues that "the dilemma in which she found herself had apparently never occurred before in the Records Department and there was no policy on what to do when it did occur." Tehven also argues that "[o]ne episode of bad judgment is far short of what is required for a finding of misconduct" which would disqualify her from receiving unemployment insurance benefits. We disagree.

The medical records manager testified to what Tehven should have done when she found her husband's misfiled lab report: "She should have just left it there and left me a note that there was some lab work that I should have, indicate the patient's name, the patient's number, and then I would have gone to the file, removed it, and filed it in the chart." Although she testified that the Hospital had no written procedures concerning such an event, she also testified: "Most staff will leave me the note so I'm the one handling it. They don't even have to look at it then."

There is evidence that there was an unwritten policy that a medical records employee, upon discovering a misfiled medical record, should leave the record where it was and give the medical records manager a note about it. There was also evidence that Tehven, as an 8 1/2-year employee, knew or should have known of the policy. An employer's policy need not be explicit and in writing for an employee's actions to constitute misconduct if the employee knew or should have known that the conduct involved was inappropriate and the employee's "actions evinced an intentional and substantial disregard of the standard of behavior which his employer had the right to expect from him." Marion v. Job Service North Dakota, supra, 470 N.W.2d at 612.

Furthermore, "[o]ne episode of bad judgment" can be disqualifying misconduct if it results in violation of an important employer interest or explicit policy. Blueshield v. Job Service North Dakota, 392 N.W.2d 70 (N.D. 1986); Schadler v. Job Service North Dakota, 361 N.W.2d 254 (N.D. 1985). Here, as in Schadler, where we noted that the absence of a nurse's aide, even for a short time, compromises the care given to the residents of a nursing home, the potential damage to a hospital patient from the failure to keep secure and confidential the patient's medical records, supports a conclusion that one instance of willful misconduct is sufficient.

From our review of the record, we believe that a reasoning mind could reasonably conclude that Tehven knew of and violated the Hospital's policy on confidentiality of medical records, an important hospital interest. We also believe that a reasoning mind could reasonably conclude that Tehven's conduct evinced "such wilful or wanton disregard of an employer's interests as is found in deliberate violations or disregard of standards of behavior which the employer has the right to expect of his employee", as to constitute misconduct disqualifying her from unemployment compensation benefits.

We conclude that the evidence supports Job Service's findings of fact, which, in turn, sustain its conclusion of misconduct, which supports its decision. We, therefore, affirm the district court judgment upholding Job Service's decision.

Affirmed.

ERICKSTAD, C.J., VERNON R. PEDERSON, Surrogate J., and MESCHKE, J., and HODNY, District Judge, concur.

VERNON R. PEDERSON, Surrogate Judge, sitting as a member of the Court to fill the vacancy created by the resignation of Justice H.F. GIERKE III. HODNY, District Judge, sitting due to the disqualification of Justice Levine. Justice Johnson, not being a member of this Court at the time this case was heard, did not participate in this decision.