Canterbury District Health Board has apologised for a privacy breach in which cricketer Jesse Ryder's medical file was accessed by unauthorised hospital staff.
Ryder, 28, was admitted to Christchurch hospital on 28 March with a fractured skull and collapsed lung, following an attack outside a bar in the suburb of Merivale.
Health board chief executive David Meates has confirmed four staff viewed Ryder's X-ray results when they did not have the authority to do so.
One staff member was in Christchurch, two were on the West Coast and one was in South Canterbury.
Mr Meates says the privacy breach is unacceptable and he has personally apologised to Ryder.
However he says it is reassuring to know the checks on traceable staff log-in accounts used to access patient information are working.
The Office of the Privacy Commissioner has been contacted and an investigation will be carried out.
The former Black Cap spent nearly a week in hospital following the attack and his returned home to Wellington.