Waikato DHB said only one part of the complaint was upheld and it is seeking clarification from the Commissioner.
The union said the DHB argued it had consent to use the medical notes but ASMS executive director Ian Powell believed it was a privacy breach and said the union planned to take the case to the Human Rights Review Tribunal for financial compensation.
Late last week the union warned its 350 members at Waikato DHB not to use the service or provide it with personal medical information.
It also warned other unions, including for junior doctors, nurses, orderlies, food workers and cleaners, to avoid the service.
The warning came the same week Auckland District Health Board announced it was investigating a potential privacy breach after former Silver Fern Tania Dalton's patient file appeared to have been accessed by clinicians not directly responsible for her care before she died of a brain aneurysm.
Powell said the staff service was usually used when the DHB as an employer had concerns about a staff member's health. The member must agree to the service.
He said staff were entitled to the same healthcare confidentiality as ordinary patients using public health services.
"Staff do not consent to staff outside the health and safety service browsing through their medical files."
The position was consistent with the Privacy Commissioner's Health Information Privacy Code and the Royal Australasian College of Physicians Ethical Guidelines for Occupational and Environment Physicians, Powell said.
"Breaching these standards undermines the centuries-old patient-doctor relationship of trust and confidence."
This was the first complaint of its kind to the union and Powell said none of the country's other 19 DHBs used the system the same way Waikato DHB did.
"In March last year we wrote to Waikato DHB seeking an assurance that if unauthorised access to staff medical files had occurred, this practice would cease."
The Privacy Commissioner told the Herald it would not comment on individual complaints.
Waikato Hospital director of people and performance Greg Peploe said the Privacy Commissioner found that the DHB did not breach the doctor's privacy for the substantive complaint.
"One part of the complaint was upheld and we are seeking clarification from the Privacy Commissioner about this.
"If ASMS has any concerns about our occupational health and safety processes we are happy for them to contact us to discuss."
A spokeswoman said the DHB "absolutely" stood by the OHS service but said the complaint decision was private and Peploe's comment was all the DHB could add.