Employee fired at Heartland Health for privacy breach

KINDERSLEY, Sask. – An employee of the Heartland Health Region has been fired and several other measures taken after the patient records of approximately 900 people were accessed inappropriately. “The privacy of personal health information is something we take very seriously and we extend our sincere apologies to those patients affected by this breach,” said Greg Cummings (pictured), president and CEO for the Heartland Health Region.

According to a news release, someone reported an alleged breach of privacy in July of this year. The region launched an investigation and found that patient electronic medical records had been inappropriately accessed over the course of 14 months.

The Heartland Health Region covers more than 41,000 square kilometres in west central Saskatchewan.

As a result of this situation, the following actions have been taken by the Health Region:

• The employee has been terminated and the employee’s professional association has been notified of this action.
• A letter has been mailed to all affected patients explaining the breach and the region’s follow up actions.
• The Office of the Saskatchewan Information and Privacy Commissioner, the Ministry of Health and eHealth Saskatchewan have been informed of the breach.

Additional corrective actions that the region will undertake include:

• Reviewing and limiting access to ensure the security and safety of personal health information;
• Reviewing internal approval and authorization processes when new electronic systems are implemented;
• Reviewing existing provincial privacy impact assessments and/or implementing regional privacy impact assessments as necessary;
• Developing a process to regularly audit and monitor all electronic systems; and
• Reviewing staff education related to confidentiality and the privacy and protection of personal health information.

Earlier this year, two employees with the Saskatchewan Cancer Agency were disciplined and then put back on the job, after breaching the privacy of 48 patients. A health records clerk in the Saskatoon Health Region was also kept on the job after viewing the records of six individuals, without a need to know. A care aide’s privacy was breached when information was given from Oliver Lodge to the Saskatoon Health Region, and then to the government, with the Premier’s Office releasing some information to the media.