Health Department blasted for 'disappointing' response to pharmacist snooping case

Nova Scotia's privacy commissioner says the confidential drug records of Nova Scotians are still not as secure as they should be, and she blames a lack of action by the Department of Health.

On Monday, Catherine Tully​ called the department's response to two reports she released last month "very disappointing."

The reports, one aimed at Sobeys, the other at the department, chronicled the actions of a Greenwood, N.S., pharmacist who worked for Sobeys and over a two-year period accessed the confidential drug records of 46 people.

While Tully said she's pleased with how Sobeys has responded, she is unhappy with the Department of Health. Officials from the department have refused to meet with her office, she said, despite three attempts to arrange a meeting to discuss the report and its recommendations.

"They haven't accepted some of the major recommendations and my view is that it means that the risks that we've identified with respect to snooping have not been adequately mitigated by the department," Tully said.

Tully's investigation found that pharmacy manager Robyn Keddy had used the province's Drug Information System to check on her child's girlfriend, the girl's parents, her child's friends and teachers, her relatives and even someone with whom she had had a car accident.

Last month, Tully said the pharmacist had used the system like "a social media site" where she could check in on family and friends.

The pharmacist was fired by Sobeys. The company, Tully said, has taken other steps to "effectively mitigate the risks we identified in the investigation report."

"From the Sobeys perspective, they've done I think everything they can do," she said.

But the organization primarily responsible for securing data in the Drug Information System is the Department of Health, she said. 

"In this case, it seems that there was very little effort to find a way to make the recommendations happen and instead, for the most part, they rejected," Tully said.

Department disagrees

In an email to CBC Monday afternoon, the Health Department disputed Tully's characterization of its response.

"We want Nova Scotians to be confident their personal information is safe, and we are making positive changes as a result of the privacy review officer's recommendations," wrote spokesperson Tracy Barron.

"The department agrees with nine of the 10 recommendations, with the final recommendation still under review."

Barron also denied officials refused to meet to discuss the report.

"At no point did the department refuse to meet with the privacy office," she wrote. "If the privacy review officer would still like to meet for further clarification, the Department of Health and Wellness would be happy to do so."

'Law is inadequate'

According to Tully, those recommendations rejected by the department include automatically conducting detailed audits of a database user's activity if they've used the database to breach privacy; developing protocols to investigate anonymous tips; developing specific notification requirements as part of privacy breach protocols.

"The primary objective needs to be protecting the privacy of Nova Scotians and that does not appear to be happening here," Tully said.

Tully sent Health Minister Randy Delorey a letter Friday requesting a meeting in a last ditch effort to convince the department it needs to do more, but the commissioner understands there's little else she can do to force action.

"The law is inadequate that it does not give me order-making power, and the department does not have to follow the recommendations that I've made," Tully said.

Premier Stephen McNeil has repeatedly said the office does not need that kind of extra power to do its work.