An expert in health policy questions why Alberta Health Services didn't notify the public about a 2012 privacy breach at a Calgary hospital when a hidden camera was discovered in a unisex public washroom.

"As a member of the public I would want to know what is going on," said University of Alberta associate professor John Church, who specializes in health policy.

"But under the way in which the system is currently set up, there may be no requirements, except under certain circumstances, that things like that actually get reported."

The University of Calgary and Alberta Health Services fired surgical resident Hisham Sultan in 2012 after he admitted to planting a hidden camera in a unisex public washroom in the emergency department at Foothills Medical Centre. The camera had been discovered by a hospital staff member on Sept. 21, 2012.

The health authority turned over the camera to the Calgary Police Service. A senior officer admitted to CBC News that police botched the investigation.

Image | John Church

Caption: University of Alberta professor John Church says the public often isn't informed about incidents like these. (CBC News)

Load Image

The constable responsible for the case did not view the recording and it sat in an evidence room until, at the request of AHS, it was returned 40 days after its discovery.

The health authority's security staff immediately identified the surgical resident as the person who had planted the camera. He confessed and was fired.

But because police had lost control of the evidence — the camera and its recording — the Crown declined to recommend charges.

AHS did not disclose the privacy breach to the public. CBC News learned about the incident through a tip and obtained details of the case from AHS through a freedom of information request.

Sultan declined repeated interview requests from CBC News.

This was at least the third time a hidden camera had been found at the Foothills hospital. In two previous cases, in 2006 and in March of 2012, the cameras were found in staff washrooms.

Health authority spokesperson Kerry Williamson, in an emailed statement, said the public was not notified of the privacy breach in the September 2012 case because a "thorough" AHS investigation had determined only "two individuals were impacted" and he said everyone who could be identified was notified.

"Given the fact the cameras in the September and March 2012 incidents were located in washrooms typically used only by staff, not public washrooms, the risk to the public was low and there was no basis for a broad public warning," the statement said.

But facts detailed in the health authority's own internal documents and information provided by Calgary police contradict these statements.

An internal AHS security incident report, dated Sept. 21, 2012, the same day the camera was found, states the unisex washroom in the emergency department "was used by staff, EMS (Emergency Medical Services), patients, and families."

Another document revealed that AHS security believed the camera had been moved between washrooms.

The health authority's claim that only two people were impacted isn't supported by AHS documents.

The documents show Alberta Health Services had no idea how long the camera might have been there before it was discovered. And the documents show some files on the memory card had been deleted.

The documents also show the camera recorded images on a memory card, which can be easily swapped out. That means the camera could have been used to capture other images in other locations before it was discovered.

The AHS documents show a female on the recording was identified and notified. But Calgary police say an elderly man could not be identified because only his genitals could be seen.

Williamson said AHS managers responsible for privacy determined that although the man's privacy had been breached, it still did not justify a general public notification.

The health authority is not obliged, under provincial privacy laws, to report potential breaches to the Office of the Information and Privacy Commissioner, but in this case it was reported, Williamson said. He declined to say what, if any, recommendation was provided by the commissioner. A spokesperson for the commissioner also declined to provide any information.

Image | Kerry Williamson

Caption: AHS spokesperson Kerry Williamson says the health authority notified all individuals who could be identified from the camera. (CBC News)

Load Image

"It sounds to me like a lack of transparency all around," said Church, the health policy expert.

"I mean, AHS may have done what they are required to do under the existing system and the existing system may simply be lacking," he said. "Because, quite frankly, the existing system relies heavily on self-regulation of the behaviour of health providers."

The health authority also reported Sultan to the College of Physicians and Surgeons of Alberta, the professional body that regulates doctors.

"I believe that the process undertaken by AHS and the University of Calgary appear to have sufficiently considered the behaviour and there is little else the college would be able to add to your determination," assistant registrar Dr. Owen Heisler wrote in a May 2013 letter to AHS vice-president Dr. Francois Belanger.

Spokesperson Donna Call, in an email, said the college could not discuss specific cases, but confirmed there is a system in place to ensure a resident physician can't simply go work in another province.

She said residents who have been in trouble in Alberta must provide a Certificate of Professional Conduct if they want to register in another jurisdiction, and this would "alert any college to any disciplinary issues - ours or others."

Church said it appears both the University of Calgary and the College of Physicians and Surgeons acted appropriately in this case, although he wondered if Sultan may be able to seek work in another country.

@charlesrusnell
@jennierussell_

If you have any information about this story, or for another potential story, please contact us in confidence at cbcinvestigates@cbc.ca.