Employee Snooping Reported by a Clerk’s Relative
Privacy awareness training including employee snooping awareness may prevent a privacy breach. Check out the second article in our Privacy Breach Nugget series for valuable insights and tips.
Ontario’s Information and Privacy Commissioner (IPC) opened an investigation into a hospital’s management of employee snooping after three similar privacy breach reports were received from the hospital in 2020 and 2021. The IPC elected to review the privacy breach to ensure that the custodian had adequate safeguards to prevent similar incidents.
The investigation found that the hospital had managed the breaches well and no recommendations were required. The findings were published in PHIPA Decision 204.
This is the second article in this Privacy Breach Nugget series with tips that you can use to better respond to a privacy breach in your healthcare practice.
Missed the first article? Check it out here.
What Happened
A complaint was made to an Ontario hospital by a relative of an admitting clerk that their health information was being accessed by the clerk without authorized purpose. The hospital’s Privacy Officer investigated and found that the clerk had accessed five individuals’ health records without authorized purpose. The investigation concluded with the termination of the clerk’s employment.
The incident was the second of three privacy breaches reported by the hospital to the Ontario Information and Privacy Commissioner in 2020 and 2021. This snooping is in contravention of the Personal Health Information Protection Act (PHIPA).
Managing the Breach
The Ontario Hospital’s management of the privacy breach can be examined using the 4 Step Response Plan.
Step 1 – Spot and Stop
The privacy breach was detected when the hospital’s Patient Experience Department received a complaint that an admitting clerk may have accessed a relatives health information without authorized purpose. The hospital’s Privacy Officer was notified. The clerk’s access to the EHR system was disabled and they were put on administrative leave once an audit confirmed suspicious accesses were made.
Step 2 – Investigate
The hospital conducted audits of user access of the electronic medical record (EMR) system. This revealed that the clerk accessed five individuals’ health records without a need to do this as part of her job. The investigation also established that the clerk had previously signed a statement of confidentiality and received privacy awareness training. A meeting was held with the clerk, who admitted that she used the EMR to find a mailing address of a friend.
Step 3 – Notify
The hospital notified those patients affected by telephone or mail, and the incident was reported to the Ontario IPC.
Under PHIPA s. 12(2), it is mandatory for custodians providing services in Ontario to notify patients whose personal health information has been used or disclosed without consent or authorized purpose.
Notification to the IPC is a requirement of a custodian (including hospitals and community physicians, pharmacists, dentists, and other healthcare providers.) (PHIPA regulation s. 6.3 pursuant to PHIPA s. 12.3.)
Step 4 –Prevent the Breach from Happening Again
The hospital’s disciplinary actions ended in the termination of the clerk’s employment. The hospital reviewed and committed to maintain its privacy policies and procedures.
Commissioner’s Investigation
The IPC investigation found that the hospital had managed the breaches well and no recommendations were required, and findings were published in PHIPA Decision 204.
The investigation also noted some positive measures taken by the hospital in managing privacy risks:
- All staff receive privacy awareness training and sign Statements of Confidentiality, and annual refresher training with new Statements of Confidentiality is mandatory.
- The hospital’s Privacy Office informs staff on privacy issues during a yearly email campaign called Privacy Awareness Week.
- The hospital’s Privacy Officer holds training sessions when requested or new information is available.
- The hospital’s EHR system displays a privacy advisory that staff must agree to before accessing information.
- Policies and procedures are reviewed and amended every three years and when needed.
- Policies and procedures, and investigation findings are properly documented.
- The hospital outlined a plan to respond to the breaches and the investigation. These include updating privacy awareness training with examples of snooping similar to those investigated and sending quarterly emails to staff about snooping and how to prevent privacy breaches.
Take-Aways
The hospital had pre-existing privacy awareness training and privacy breach management procedures. A review in response to the incident led the hospital to develop specific employee training to better understand and prevent snooping incidents. This is a good reminder that training is not a ‘one and done’ event. Refreshing training regularly with specific examples that relates to work activities can be more meaningful.
Watch for the next article where we share example #3 in IPC Decision 204.
Article submitted by: Aaron Myer
Reference
Ontario Regulation 329/04. Government of Ontario, 2006, https://www.ontario.ca/laws/regulation/040329#BK6. Accessed 9 June 2023.
Personal Health Information Protection Act, 2004. Government of Ontario, 2004, https://www.ontario.ca/laws/statute/04p03. Accessed 9 June 2023.
PHIPA Decision 204. Information and Privacy Commissioner of Ontario, 4 Apr. 2023, https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/521298/1/document.do. Accessed 9 June 2023.
You May Also Be Interested In
4 Step Response Plan training for clinic managers and privacy officers.