Commonwealth Bank has defended its decision to sack CommInsure chief medical officer Benjamin Koh, and argues it was not about whistleblowing.

In a submission to the Senate Economics References Committee inquiry into financial advice, the bank says Dr Koh was dismissed for “serious and repeated breaches of customers’ privacy, involving highly sensitive personal, medical and financial information over a lengthy period of time”.

“The investigation found Dr Koh sent about 230 emails, attaching a total of about 260 documents, to his personal Gmail account,” the submission says.

“The emails were unencrypted and included sensitive customer files, medical reports, financial information and CommInsure corporate information.

“Emails were sent over an extended period from November 2013 to early [last year].”

Dr Koh, who is suing the bank for wrongful dismissal in the Victorian Supreme Court, has disputed this version of events.

The bank has also defended CommInsure’s medical document management system, and denies accusations that client documents were mismanaged or destroyed.

“Investigations conducted at the time concluded all expected data was in the database, with the exception of a single document,” the submission says. “The document was manually re-entered into the system so it duplicated the opinion held on the case file.

“Based on investigations at the time, we did not find any evidence of medical files being intentionally deleted or tampered with, resulting in missing information, as has been alleged.”

The bank has accepted its heart attack definitions were out of date, and says cases cited in mainstream media have been reviewed.

One trauma claim initially denied under old heart attack definitions has now been settled.

Other publicised claims arose from group life insurance policies, and CommInsure says it has worked with fund trustees to review these.

Five claims featured in media reports. In a letter to the committee, Commonwealth CEO Ian Narev admits mistakes were made.

“Our investigations since these reports have not suggested any deliberate employee misconduct,” he says. “If anything, in these cases there appears to have been more focus on process rather than people.

“Two of those people have been paid this year. In respect of the other three customers, we have taken decisive and compassionate action to address these issues in our policies and pay their claims.”