When Co-Workers Are Victims of Snooping
Victims of snooping can report their concerns to the privacy officer of the organization where the breach occurred. When the breach involves a co-worker, your human resources policies to report a privacy incident can guide you to manage the incident and any resulting discipline. Including employee snooping awareness in privacy awareness training may prevent a privacy breach. Check out the third article in our Privacy Breach Nugget series for valuable insights and tips.
Ontario’s Information and Privacy Commissioner (IPC) opened an investigation into a hospital’s management of employee snooping after three similar privacy breach reports were received from the hospital in 2020 and 2021. The IPC elected to review the privacy breach to ensure that the custodian had adequate safeguards to prevent similar incidents.
The investigation found that the hospital had managed the breaches well and no recommendations were required. The findings were published in PHIPA Decision 204.
This is the third article in this Privacy Breach Nugget series with tips that we can learn from this report as guidance to better respond to a privacy breach in your healthcare practice.
Missed the previous articles?
Check out the first article here,
and the second one here.
What Happened
An employee phoned the hospital’s Privacy Office to lodge a complaint against a co-worker for allegedly accessing the complainant’s health information without authorized purpose. The hospital’s Privacy Officer investigated and found that a radiology assistant had accessed eleven individuals’ health records without needing that information to do their job. The hospital’s investigation concluded with the assistant being reassigned to a position without access to personal health information.
Managing the Breach
The Ontario hospital’s management of the privacy breach can be examined using the 4 Steps Response Plan:
Step 1 – Spot and Stop
The privacy breach was detected when the hospital’s Privacy Office received a complaint from an employee that a co-worker may have accessed their health information without authorized purpose. The hospital’s Privacy Officer performed an audit on the employee’s electronic health record (EHR) and confirmed there was a suspicious access made by a radiology assistant. The assistant’s access to the EHR system was disabled and they were put on administrative leave.
Step 2 – Investigate
The hospital’s Privacy Officer conducted a second audit on the assistant’s EHR accesses and found suspicious accesses were made on eleven individuals’ EHRs. The Privacy Officer determined that those individuals were searched for deliberately in the EHR system, and confirmed with the assistant’s manager that they had no reason to do so. The investigation also established that the assistant had previously signed a statement of confidentiality and received privacy awareness training. A meeting was held with the assistant who denied accessing those health records.
Step 3 – Notify
The hospital notified the victims of snooping by telephone or mail, and the incident was reported to Ontario’s Information and Privacy Commissioner.
Under PHIPA s. 12(2), it is mandatory for custodians providing services in Ontario to notify patients whose personal health information has been used or disclosed without consent or authorized purpose.
Notification to the IPC is a requirement of a custodian (including hospitals and community physicians, pharmacists, dentists, and other healthcare providers.) (PHIPA regulation s. 6.3 pursuant to PHIPA s. 12.3.)
Step 4 – Prevent the breach from happening again
The hospital took progressive disciplinary actions with the employee by reassigning them to a position without access to personal health information (PHI) after their administrative leave ended. The reassignment was following up a few months later with an audit to ensure PHI was not being accessed. The hospital also reviewed and committed to maintaining its privacy policies and procedures.
Commissioner’s Investigation
The IPC investigation found that the hospital had managed the breaches well and no recommendations were required, and findings were published in PHIPA Decision 204.
The investigation also noted some positive measures taken by the hospital in managing privacy risks:
- All staff receive privacy awareness training and sign Statements of Confidentiality, and annual refresher training with new Statements of Confidentiality is mandatory.
- The hospital’s Privacy Office informs staff on privacy issues during a yearly email campaign called Privacy Awareness Week.
- The hospital’s Privacy Officer holds training sessions when requested or new information is available.
- The hospital’s EHR system displays a privacy advisory that staff must agree to before accessing information.
- Policies and procedures are reviewed and amended every three years and when needed.
- Policies and procedures, and investigation findings are properly documented.
- The hospital outlined a plan to respond to the breaches and the investigation. These include updating privacy awareness training with examples of snooping similar to those investigated and sending quarterly emails to staff about snooping and how to prevent privacy breaches.
Take-Aways
The hospital had pre-existing privacy awareness training and privacy breach management procedures. A review in response to the incident led the hospital to develop specific employee training to better understand and prevent snooping incidents. This is a good reminder that training is not a ‘one and done’ event. Refreshing training regularly with specific examples that relates to work activities can be more meaningful.
Check out the previous articles in this series for the 2 other snooping examples from IPC Decision 204.
Also see: Managing Employees When They Make Mistakes With Stacey Messner and check out Stacey’s tips on how to have difficult conversations with employees.
Article submitted by: Aaron Myer
References and Resources
PHIPA Decision 204. Information and Privacy Commissioner of Ontario, April 4, 2023, https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/521298/1/document.do
You May Also Be Interested In
4 Step Response Plan training for clinic managers and privacy officers.