Alberta health-care workers suspended for patient privacy breach

CBC News has confirmed that one health-care employee has been fired and 47 other workers in Calgary are facing disciplinary action this afternoon for "inappropriately" accessing a patient's information.

"All of these individuals now face disciplinary action, including suspensions without pay ranging from two to five days, and one termination," said Alberta Health Services CEO Vickie Kaminski in an email statement.

• Alberta Children's Hospital patient privacy breach prompts apology
• Laptop stolen from Lethbridge clinic had patient information, AHS says

Kaminski said the actions underscore the very real consequences of these types of breaches.

"All AHS employees, physicians and volunteers are accountable for patient privacy. It is not only the right thing to do, it is the law," she said.

"While I commend the vast majority of AHS employees and physicians who respect patient privacy and appropriately access patient information every day, I cannot stress enough the seriousness with which AHS takes patient privacy, and any breach that does occur."

The statement says AHS also reports privacy breaches to the Office of the Information and Privacy Commissioner, who can prosecute and impose fines. 

Nurses union calls for resignation

Within a couple of hours of the AHS announcement, the United Nurses of Alberta (UNA) released a strongly worded statement saying the "honourable" thing would be for Kaminski to resign because of the way the statement was issued and the confidentiality of employees was breached. The union also disagrees with the conclusions of the AHS about the privacy breach.

"In this case, United Nurses of Alberta vigorously disputes the conclusions reached by the employer in all cases and is confident that upon application of due process the actions against our members will be shown not to be justified under the circumstances and the law." 

The union also said the protocol for issuing the statement was not followed because the union was not notified and disciplinary meetings had not been done with all affected employees. Further, the statement about the breach was widely distributed in a large workplace and identities of the employees facing discipline are well known, and the information was leaked to media.

UNA believes this a breach of confidence illegal under Alberta privacy legislation. They plan to pursue the matter.  

Privacy commissioner investigating

Scott Sibbald, a spokesperson for Alberta's privacy commissioner, confirmed in a statement that AHS submitted "high-level details" of the breach on Sept. 18.

"Our office is investigating this situation but considering we handle these situations on a case-by-case basis, and the magnitude of this particular breach, we have to perform our due diligence under the legislation before speaking specifically on these incidents — or whether these incidents will lead to offence investigations," Sibbald said. 

"More broadly, improper access of health information is becoming an epidemic within electronic medical record systems." 

This year alone, Sibbald notes there has been one conviction and two charges for improper access of health information. The office is also currently handling numerous other breaches that could become offence investigations.

"There's a number of other cases, I think more than a dozen, that have the potential at this point to become offence investigations as we collect more details," he told CBC News.

In total, there have been four convictions under the Health Information Act that have resulted in fines, including one with Criminal Code charges.