CORNER BROOK When investigating privacy breaches at two health authorities in the province, Information and Privacy Commissioner Ed Ring said he had to consider what else could be done to deter others from doing the same thing.
Ring said there have been breaches in the past that resulted in people losing their jobs, but the practice has continued. That’s part of the reason why Ring made use of a section the Personal Health Information Act (PHIA) to charge a former employee of Western Health and a former employee of Eastern Health with separate offences covered under the Act. The charges were announced in a press release issued by the office Thursday morning.
In a phone interview from his office in St. John’s, Ring said the investigation marked the first time the Office of the Information and Privacy Commissioner has used section 88(1)(a) of the Act to lay charges against an individual.
In the Western Health case, a former clerk at Western Memorial Regional Hospital allegedly accessed the files of 1,043 patients inappropriately. The health authority went public with the breach last August following an investigation that looked at access to patient records from June 2011 to May 2012. The health authority issued apology letters to all involved and fired the clerk.
Ring said his staff conducted two separate investigations into the alleged breaches after people started filing complaints with his office. The office had already been made aware of the breaches by the two health authorities.
The investigations included looking at the individuals involved, their job descriptions, responsibilities and duties. Investigators also looked at audit logs and spoke with officials with both health authorities about what was acceptable and not acceptable as it related to procedures and protocols.
“At a certain point, I made the decision that because of the nature of these breaches and the numbers involved and the fact that these weren’t the first ones that occurred ever, that there is an offence section of the act and I felt that the criteria was there to proceed.”
He said the charges should help to serve as another level of deterrence for people who may consider doing the same thing. Ring said they may think twice about it knowing they could end up before a judge. Penalties for violation of the Act include a maximum fine of $10,000 or six months in jail.
“This is warranted,” said Ring of the charges. “This is the step that was needed and why the Act is written as it is with section 88 in there, to add this other level of deterrence.”
The first appearance on the matter involving a former Eastern Health employee is set for May 3 at provincial court in St. John’s, while the matter involving the former Western Health employee is set for May 28 at provincial court in Corner Brook.
While not named in the release sent out by the Office of the Information and Privacy Commissioner, at least one civil lawsuit filed as a result of the breach that is currently before the Supreme Court in Corner Brook names Donna Colbourne as the former Western Health employee allegedly responsible for the breach.
In an email response for comment on the charges, Western Health said that it is supportive of the Office of the Privacy Commissioner and the commissioner’s efforts to support the privacy legislation within Newfoundland and Labrador.
But the health authority declined to comment further, saying the matters are human-resources related and are now before the courts.
Meanwhile, Health Minister Susan Sullivan, who was in Corner Brook on Thursday to speak at a meeting of the Rotary Club, said the province has a number of procedures in place to deal with breaches and will continue to follow those.
“That is something we can not tolerate and will not tolerate within the health-care system,” said Sullivan. “Rest assured it’s something that we take very seriously and will be monitoring.”