Former Sobeys pharmacy manager 'snooped' into drug records of 46 people

Nova Scotia's privacy commissioner is lambasting a Sobeys pharmacist for snooping through the private medical records of 46 people over a two-year period.

The College of Pharmacists confirmed the woman at the centre of the investigation was Robyn Keddy, who managed the pharmacy in Greenwood, N.S., a rural community about 150 kilometres northwest of Halifax.

Information and Privacy Commissioner Catherine Tully's investigation found that Keddy routinely searched through prescription information of people she knew — who were not her patients. 

"It's as if this pharmacist thought of the Drug Information System as a social media site where she could check in on friends and family and see what they were up to." Tully said.

"It has that feel to it — that casualness. That's shocking." 

Fake customer profiles

Keddy used the province's Drug Information System to check on her child's girlfriend, the girl's parents, her child's friends and teachers, her relatives and even someone with whom she had had a car accident, according to two reports released by the privacy commissioner's office on Wednesday.

She created fake customer profiles at the pharmacy, which would allow her to see patient information including addresses, phone numbers and prescription details through the provincial drug database.

"The pharmacist… falsely claimed that individuals had consented to the creation of the record," said the report.

'Violated that trust'

​Tully blasted the pharmacist for violating the integrity of the patients with sensitive information in the database.

"She was trusted to see that information strictly for work purposes and she violated that trust," the privacy commissioner said.

Through interviews with pharmacy employees, Tully determined that some staff knew about the privacy violations, but she says they were scared to come forward because Keddy was also their manager. 

The privacy commissioner also criticized the way both Sobeys and the Department of Health and Wellness responded when they learned of the breach of records. 

Sobeys "failed to act in a timely fashion to properly and thoroughly investigate and contain these privacy breaches," Tully wrote in her reports. 

She said Sobeys still hasn't resolved the breach, because 28 fake customer profiles still exist in the pharmacy computer system.

Both Tully and Sobeys told CBC News that Keddy has since been fired.

In late July, the College of Pharmacists issued a disciplinary notice against Keddy for multiple breaches of the province's Drug Information System. 

The college suspended the pharmacist's licence and ordered her to pay a $5,000 fine and another $4,000 in costs.

"It's irrelevant from the College's perspective why you engage in that misconduct," its registrar, Beverly Zwicker, told CBC. "The College believes that strong sanctions are required to send a clear message to pharmacy registrants that we take the responsibility… to maintain the confidentiality of the personal health information seriously."

Sobeys responds

When contacted for an interview, Sobeys provided CBC News with a statement that confirmed it had terminated the pharmacist and alerted the College of Pharmacists about the breach. It did not specify when it did either of those things.

"Maintaining patient trust and confidentiality is a top priority and fundamental to our business," the statement said. "Unfortunately, the scenario outlined in the report is the result of unethical actions by one individual."

The privacy report also questions the health department's response after learning of the breach.

"As a result of the inadequate investigation, the [department] did not sufficiently canvass the risks associated with the breaches and did not sufficiently contain the breaches," Tully wrote.

Tully makes 10 recommendations, including instructing the Department of Health and Wellness to recontact those whose records were accessed, in order to find out if the pharmacist has been in contact with them since last April.

"If so, the DHW must take further legal action to prevent the ongoing unauthorized use or disclosure of the personal health information."

All 46 victims have been alerted to the privacy breach.

The health department told CBC News that the minister was unavailable for an interview. Instead, a spokesperson said that staff would review Tully's report and provide a response within the 30-day time limit.

'Huge slap in the face'

Stephanie Butler, a nurse who lives in Greenwood and works in the health-care field, said the privacy breach is "quite serious" in the small community.

"Everyone knows everyone anyway, we only get that little bit of privacy. We trust someone to respect our privacy," said Butler

"And where she was snooping through for her only personal needs or her own personal gains, that was a huge slap in the face. And I feel that her being fired was appropriate action."

Butler said in her job, she sometimes looks after the loved ones of people she knows. But she said she can't tell them anything about the loved ones in her care.

"I can't go and tell them, 'Oh, I saw your father today.' I can't do that. There's privacy, there's confidentiality in place for a reason," Butler said.

"And if I can't go and talk to everyone about things that I've seen, she's shouldn't be able to go snooping through files and finding out what prescription medications people are on. That is breach of confidentiality 101."