N.W.T. man's blood test results 'inadvertently faxed' to wrong government department

Andy Kudlak checked his mailbox in Paulatuk, N.W.T., hoping that a letter from the territorial government might include some test results he was waiting for. 

What he got instead was a privacy breach notification explaining that on Nov. 9, 2019, a third-party contractor "inadvertently faxed" his name, date of birth, blood results from Alberta company DynaLIFE Medical Labs, and his health care number to the Department of Municipal and Community Affairs.

"I didn't know what to say," said Kudlak. "I was disappointed because it went to another place."

As per the territory's Health Information Act, the Northwest Territories Health and Social Services Authority reported the breach of Kudlak's privacy to the territory's privacy commissioner. 

We continue to receive breach notifications which involve misdirected faxes on a weekly basis.- Elaine Keenan Bengts, N.W.T. privacy commissioner

The letter to Kudlak explains that the authority will advise the privacy commissioner about an investigation, any findings and how it will prevent similar events from happening in the future.

Authority 'confident' issue won't persist

The Northwest Territories Health and Social Services Authority declined an interview for this story, but departmental spokesperson Lisa Giovanetto said in an email that the breach was not caused by the health authority, and the authority is "confident" issues won't persist. 

Alberta Health Services and DynaLIFE were the two third parties involved in the breach. DynaLIFE Medical Labs provides diagnostic lab services in Alberta. Giovanetto clarified Tuesday that the authority has contracts with DynaLIFE labs to provide lab testing for N.W.T. patients.

The company did not respond to requests for comment.

When asked whether third parties like DynaLIFE are bound by the N.W.T. privacy commissioner's recommendation to stop using faxes, Giovanetto said in some cases, fax technology is still needed to deliver care; some communities lack reliable access to internet and fax technology is still necessary.

Giovanetto said Kudlak's results ended up being faxed to the wrong department in the N.W.T. because of recent changes to how Alberta Health Services manages patient information.

On Nov. 3, Alberta Health Services migrated its provincial electronic information system to a new one called Connect Care, Giovanetto said. They moved to a province-wide laboratory information system called EPIC Beaker, which is used to transmit test results, including N.W.T. lab tests.

During that migration, the results for N.W.T. lab tests were arriving inconsistently, said Giovanetto. Alberta Health Services temporarily resorted to faxing results, but some fax numbers were mixed up, she said.

Once the N.W.T. health authority learned of the situation, it stopped all faxing from EPIC Beaker. Clinical and technical teams in both Alberta and the N.W.T. were formed to troubleshoot the Alberta health electronic information system.

Class-action lawsuit

Kudlak says his complaint has been passed on to Cooper Regel, the firm leading a lawsuit over health privacy breaches in the territory.

Lawyer Steven Cooper says breaches like the one affecting Kudlak likely fit under the type of complaints covered by the representative action. A representative action is similar to a class-action lawsuit.

Cooper Regel filed its statement of claim on Sept. 3, 2019, but hasn't heard back from the territorial government. 

Cooper says the lawsuit will seek significant punitive damages because the system is "so malformed and ill-considered in its design that it will continue to do what it is doing now."

As the representative action begins, Cooper says he expects the known breaches are the "proverbial tip of the iceberg."

"I will be pleasantly surprised, as a former N.W.T. resident and lawyer, if there's not more below the surface," he said. 

Misdirected faxes every week

In a report tabled Dec. 11, 2019 in the legislative assembly, N.W.T. privacy commissioner Elaine Keenan Bengts said the government continues to ignore her plea to stop faxing private health information.

"It's a problem throughout Canada in that, for some reason, medical practitioners insist on continuing to use fax machines to communicate personal health information.

"We continue to receive breach notifications which involve misdirected faxes on a weekly basis." 

In some northern communities where Internet bandwidth is an issue, faxing is still commonly used.

Keenan Bengts says she doesn't want to cast health practitioners as being indifferent to privacy.

"The medical services sector is resisting the use of more secure means of communications like encrypted email" and electronic transfer within the medical record system, she said.

She says the most common breaches that occur within the health system is when someone mistakenly faxes personal information to the Yellowknife Primary Care Centre instead of Stanton Territorial Hospital.  

"It's still a breach, right? But it's — you know — they pushed the wrong button."