Media Story Reveals Employee Snooping
Media Story Reveals Employee Snooping
Ontario’s Information and Privacy Commissioner (IPC) opened an investigation into a hospital’s management of employee snooping after three similar privacy breach reports were received from the hospital in 2020 and 2021. The IPC elected to review the privacy breach to ensure that the custodian had adequate safeguards to prevent similar instances.
The investigation found that the hospital had managed the breaches well and no recommendations were required, and findings were published in PHIPA Decision 204.
In this Privacy Breach Nugget series, I will take a look at each of these three incidents as guidance to better respond to a privacy breach in your healthcare practice.
What Happened
A news media story was published containing the names of patients at an Ontario hospital. The hospital Privacy Office initiated an audit which found that a Patient Accounts Clerk had accessed 28 health records without authorized purpose. This snooping is in contravention of the Personal Health Information Protection Act (PHIPA).
Managing the Breach
The Ontario Hospital’s management of the privacy breach can be examined using the 4 Step Response Plan.
Step 1 – Spot and Stop
The privacy breach was detected by the hospital when the media story aired. The hospital ran a preliminary audit on the health records of those patients named in the story that found suspicious access by an accounts clerk. Once identified, the hospital disabled the clerk’s access to the electronic health record (EHR) system and put them on administrative leave.
Step 2 – Investigate
After identifying the clerk, the hospital initiated second and third audits on their EHR accesses and found 28 patients whose records were accessed without authorized purpose. This is also known as employee snooping. The investigation established that those patients had been deliberately searched for in the EHR system, confirmed with the clerk’s manager that no authorized purpose was given to do so, and that the clerk had previously signed a Statement of Confidentiality and completed privacy and security awareness training.
Step 3 – Notify
The hospital notified those patients affected by the breach by telephone or mail. Under PHIPA s. 12(2), it is mandatory for custodians providing services in Ontario to notify patients whose personal health information has been used or disclosed without consent or authorized purpose.
Notification in this case was delayed for compassionate reasons as some of the health information accessed was from a deceased patient. One patient was not able to be contacted, and a note on their file was made for the registration department to notify the hospital’s Privacy Office the next time the patient registered at the hospital. The patient will be informed of the privacy breach on their return visit to the hospital.
The hospital also notified the IPC of the incident. It is mandatory for a custodian providing services in Ontario to report a privacy breach of personal health information to the IPC (PHIPA regulation s. 6.3 pursuant to PHIPA s. 12.3.)
Step 4 –Prevent the Breach from Happening Again
The hospital considered disciplinary action with the clerk; however, the clerk retired before any actions were taken. Policies and procedures at the hospital were reviewed, and changes made to immediately notify deceased patients’ families of a privacy breach going forward. The hospital’s Privacy Officer will now work closely with the Human Resources department to ensure more consistent investigations.
Commissioner’s Investigation
In the IPC report, the investigation also noted some positive measures taken by the hospital in managing privacy risks:
- All new staff receive privacy awareness training and sign Statements of Confidentiality. Annual refresher training with new Statements of Confidentiality is mandatory.
- The hospital’s Privacy Office communicates with staff on privacy issues during a yearly email campaign called Privacy Awareness Week.
- The hospital’s Privacy Officer holds training sessions when requested or new information is available.
- The hospital’s EHR system displays a privacy advisory reminder that staff must agree to before accessing information.
- Policies and procedures are reviewed and amended every three years and when needed.
- Policies and procedures, and investigation findings are properly documented.
- As a result of this incident, the hospital outlined a plan to respond to the breaches and the investigation, and to future breaches involving patients who are deceased. These include updating privacy awareness training with examples of snooping similar to those investigated and sending quarterly emails to staff about access without authorized purpose and how to prevent privacy breaches.
Take-Aways
The hospital had pre-existing privacy awareness training and privacy breach management procedures. A review in response to the incident led the hospital to amend their notification procedures for privacy breaches involving deceased patients. Notification to the family will be made immediately in future when breaches involve a deceased patient.
You might need to consider modifying your policies and procedures, too, to include a similar scenario.
Watch for the next article where we share example #2 in IPC Decision 204.
Article submitted by: Aaron Myer
Reference
Ontario Regulation 329/04. Government of Ontario, 2006, https://www.ontario.ca/laws/regulation/040329#BK6. Accessed 9 June 2023.
Personal Health Information Protection Act, 2004. Government of Ontario, 2004, https://www.ontario.ca/laws/statute/04p03. Accessed 9 June 2023.
PHIPA Decision 204. Information and Privacy Commissioner of Ontario, 4 Apr. 2023, https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/521298/1/document.do. Accessed 9 June 2023.
You May Also Be Interested In
4 Step Response Plan training for clinic managers and privacy officers.
