Nova Scotia Health contacting 2,690 patients after privacy breach

Nova Scotia Health said it will be contacting 2,690 patients after their personal information was "inappropriately accessed" at Saint Martha's Regional Hospital in Antigonish, N.S.

"We are extremely disappointed that an employee of Nova Scotia Health would engage in activity of this nature. Nova Scotia Health will not tolerate any unauthorized access or snooping," Derek Spinney, the health authority's chief financial officer and vice-president of corporate services, told reporters on Friday.

Spinney said an employee connected to the privacy breach was fired. Only one person is believed to be involved with the breach, Spinney said. He wouldn't say what the person's role was, but did reveal it was "not clinical in nature."

The health authority said the suspicious activity was identified in September 2023 and the person was suspended immediately and removed from their role. The person was officially fired in November.

The reason these details are only being made public now is because the health authority said it needed to do a "fulsome investigation" to figure out whose data was compromised and what specific information was accessed.

"That's why we're spending a lot of time making sure we know exactly what was touched so that we can contact each of the 2,690 people individually to work through this with them," Spinney said.

Registration, demographic and clinical info accessed

In a news release, the health authority said registration, demographic, and clinical information was accessed.

Clinical would include things like lab test results, imaging results and notes related to an emergency visit or inpatient stay. 

Demographic information would include names, addresses, emails, phone numbers, health card numbers, emergency contact or next of kin, and the names of primary care providers. It would also include registration information, including the reason a person is at the hospital, their initial health assessment and the name of the attending physician.

'This is extremely serious'

Spinney said the Nova Scotia privacy commission and the RCMP were contacted to investigate.

Because of privacy reasons, Spinney couldn't say how the employee was caught or what their motives may have been.

Spinney said Nova Scotia Health has more than four million registrations every year and the number of people impacted by the breach would account for 0.0006 per cent of the registration the health authority does. 

"That isn't meant to make light of it. This is extremely serious," Spinney said, adding even one breach is one too many.

Spinney said the health authority doesn't suspect any additional employees of being involved in the breach.