Nunavut's health records 'ripe for privacy breach', says territory's information commissioner

Elaine Keenan Bengts, Nunavut's Information and Privacy Commissioner, says privacy isn't a priority within the territory's Department of Health.

Keenan Bengts was in Iqaluit Wednesday, appearing before a standing committee at Nunavut's legislature to answer questions on her privacy audit of the Qikiqtani General Hospital.

• Staff at Nunavut hospital need more training to ensure patients' privacy protected

The report, released in December, found that nobody was in charge of ensuring staff followed privacy regulations, staff could still access files even after their jobs no longer required them to, and piles of patient charts were left unattended, among other findings.

In speaking to MLAs, Keenan Bengts said the Department of Health's slow reaction to her report was telling.

"When I provided the Department of Health with the opportunity to comment on the draft report before it was submitted to the Legislative Assembly, I received no substantive comments," Keenan Bengts said, adding she didn't get any feedback until last week when the department responded to, and accepted, the report's 31 recommendations.

"This is a concern. It suggests to me that privacy is not a priority for the Department of Health. Good privacy practices require intention and leadership. Nothing will change without leadership."

Later in the proceedings, when prompted by a question from Tununiq MLA Joe Enook, Deputy Minister of Health Coleen Stockley clarified they didn't intend to wait until last week to respond to the report, but were instead working on addressing its immediate concerns.

Health records storage 'ripe for privacy breach'

While diving into the finer details of the report, Keenan Bengts said the way health records were kept provided an environment "ripe for privacy breach."

"In fact, I think you could say, maybe, that within the medical health records office itself there was a privacy breach," she said.

"There were records all over the place that were clearly not supposed to be where they were. That constitutes privacy breach. Because it means somebody who doesn't have the right to see that information can see it."

Keenan Bengts's report stressed, perhaps most urgently, the need for a dedicated full time Chief Privacy Officer, whose job it would be to develop privacy compliance procedures and enforce them.

Stockley said the government had tried to create such a position in 2011 but couldn't fill it. Instead, there are two positions — a clinical advisor and a risk-management coordinator — sharing responsibilities that would have been handled by a Chief Privacy Commissioner.

The problem, Keenan Bengts said, is neither of those two positions have a background in privacy issues.

"They're doing it as part of other jobs. Their focus is not in the one place where it should be, in my opinion, and that is on privacy," Keenan Bengts said, despite acknowledging the struggle to find the right person for the job.

"Although it's a fix for the time being, it's not the fix the hospital needs."

She later added a Chief Privacy Officer would be responsible for correcting privacy breaches, of which Keenan Bengts said were many.

"There were a lot of things that we noticed," Keenan Bengts said. "Our report would have been three feet high had we pointed to every breach."

Territory-wide move to electronic medical records

The standing committee also heard how the territory is moving ahead toward converting many of their health centres to electronic medical records.

The Qikiqtani General Hospital already uses a Meditech system, which logs all health services provided to patients in the city.

But the communities are quickly being equipped with electronic capabilities.

Stockley told the committee Kimmirut is the latest community to be connected, as of May 1. There are now 10 communities on the system, with another 10 communities expected by the end of the year.

When fully operational, the system will hold everything from blood work results to X-rays and nurse's notes. The system will also reduce the wait time for X-ray results in communities from an average of 22 days down to 1.7 days, according to Stockley.

It's unclear whether the medical records in one community health centre will be accessible from another community, or what privacy protocols are in place under the new electronic system in the communities.

When asked by Enook if the system was secure, Stockley would only say the department is committed to making sure the right people have access to it.