Ontario prosecutes hospital workers for snooping

TORONTO – Three hospital workers have been charged under Ontario’s health privacy law for unauthorized access to former mayor Rob Ford’s (pictured) medical records after he was diagnosed with cancer.

If convicted, this will be the first time in Ontario’s history that an individual has been successfully prosecuted under the Personal Health Information Protection Act (PHIPA) – which came into force more than a decade ago.

According to the Toronto Star, the allegations include “willfully collecting, using or disclosing personal health information” at the University Health Network (UHN) Princess Margaret Cancer Centre in January.

UHN and the Ministry of the Attorney General, which laid the charges, would not disclose any information about the allegations or the three accused hospital workers, claiming the matter was now before the courts.

Online profiles indicate all three worked in the radiation department at Toronto’s Princess Margaret Cancer Centre. They are due to appear in court on Aug. 20.

After Ford’s cancer diagnosis last September, health professionals were caught snooping into his medical records in four separate privacy breaches in at least three Toronto hospitals, the Star reported in February.

His medical files were inappropriately accessed first at Humber River Regional Hospital, where his cancerous tumour was found. His health information was then opened without authorization at Mount Sinai Hospital in October, where he was transferred for chemotherapy.

The University Health Network (UHN) then notified the privacy commissioner that Ford’s records had been inappropriately targeted again by seven staff members at the Princess Margaret Cancer Centre on two separate occasions in January. Three individuals now face prosecution.

Information and Privacy Commissioner Brian Beamish said he could not comment on the prosecution because it was now before the courts.

However, earlier this year Beamish told the Star the breaches at UHN were “extremely troubling” because it meant the previous high-profile violations of Ford’s records had not acted as a deterrent to hospital employees.

In March, Beamish referred two of the snooping UHN employees for prosecution to the Ministry of the Attorney General – marking the second time an Ontario privacy commissioner has ever requested a prosecution under PHIPA.

The first time the commissioner referred a case for prosecution was in 2011, after a North Bay Health Centre nurse was accused of inappropriately accessing nearly 6,000 patient records. The charges against her were dismissed earlier this year after a court ruled the Crown was unacceptably delaying the case.

Unlike in other provinces, a prosecution under PHIPA must be launched within six months of a breach occurring, which means the hospital, the privacy commissioner and the police must complete their investigations and lay charges all within a six-month window.

Health Minister Dr. Eric Hoskins vowed sweeping changes to the act in June.

The changes – not yet introduced in the legislature – include eliminating the six-month deadline to prosecute and doubling the fines for offences under the act to $100,000 for individuals caught snooping and $500,000 for organizations.