Vitalité Health Network informs patients of privacy breach
CBC News | Posted: February 24, 2014 8:07 PM | Last Updated: February 25, 2014
A Moncton doctor accessed personal medical records without authorization dating back to 2010, letter says
The Vitalité Health Network is informing some patients their personal medical records were accessed without authorization.
The privacy breach was discovered a year ago.
"We wish to assure you that the privacy of personal information and personal health information has been our priority in all decisions in this matter," a letter sent to patients earlier this month states.
A doctor with the Dr. Georges-L.-Dumont University Hospital Centre gained unauthorized access to the files using two hospital computers between Sept. 6, 2010 and Nov. 30, 2012, the letter signed by Vitalité CEO Rino Volpé states.
The compromised information could include the reason a patient was referred, the types of tests or examinations the patient underwent, the results, and the diagnosis, according to the three-page letter.
It could also include their medicare number, as well as demographic information, such as name, age, address, and telephone number.
"Since the discovery of this access, Vitalité Health Network has taken corrective action to protect patients' personal information and has implemented restrictions and monitoring governing the physician's access," Volpé states in the letter.
"To date, no proof or facts have emerged to suggest that the information was shared or used in any other manner," he said.
"We also envisage taking the appropriate disciplinary action under the circumstances."
Vitalité officials refused to say whether the doctor is still working at the Dr. Georges-L.-Dumont University Hospital Centre.
The regional health authority is expected to speak publicly about the case on Tuesday.
142 incidents under investigation
There were 142 incidents of unauthorized access, New Brunswick's Privacy Commissioner Anne Bertrand told CBC News on Monday. She declined to say whether that meant 142 patients were involved.
Bertrand was notified by Vitalité about the privacy breach last March — one month after the regional health authority became aware of the situation.
"The fact that there was an allegation that a doctor was having … access that might be unauthorized at the time really raised an alarm," said Bertrand, whose office is investigating.
"Patient health records that contain the most private personal information a person can hold — it goes to the very heart of how we want to run our health care system here in New Brunswick," she said.
"Patients have to feel comfortable to share their information with their doctors, with their nurses, with the hospitals, with the health care centres. And if there is any kind of reservation on that part, [they're] not going to be that forthcoming."
Bertrand expects to release a full report on the case within a few months.
It's unclear why the doctor wanted people's personal information, but experts in health policy say there could be many reasons.
"It may be merely out of interest. It may be that the physician was wanting to sell the information to an insurance company, to a pharmaceutical corporation. There are lots and lots of reasons," said Elaine Gibson, a professor at Dalhousie University's Health Law Institute.
The Dr. Georges-L.-Dumont University Hospital Centre is one of the province's largest hospitals.
"Vitalité deeply regrets the incident and offers its most sincere apologies for any inconvenience it may have caused you," the letter to affected patients states.
Patients are encouraged to contact the privacy office of Vitalité if they want more information.
They may also file a complaint with the privacy commissioner if they are dissatisfied with the investigation and follow-up, it states.
There are 180 doctors at the Dr. Georges-L.-Dumont University Hospital Centre.