CHEO employee shared 283 patient records with students

OTTAWA – A part-time instructor at Algonquin College, who was also an employee of the Children’s Hospital of Eastern Ontario (CHEO), shared the private information of 283 patients with students. The breach of privacy prompted the person’s dismissal from the college and launched a privacy investigation at the hospital.

The Ottawa Citizen newspaper reported that on March 10, Adam Vaughan received a letter in the mail about his seven-year-old daughter, who had been at the children’s hospital for a procedure earlier this year. The letter informed him that his daughter’s private information had been shared with Algonquin students by their instructor, also a CHEO employee.

Vaughan was upset by the breach. He told the Citizen, “The fact that somebody would take my daughter’s personal information and feel that it’s alright to take it outside of the workplace where it’s supposed to be secured and then transfer it to a bunch of students, with no disclosure to me? I would have never ever expected this.”

The letter was sent by the hospital’s chief privacy officer Roxanne Riendeau.

“At CHEO, privacy is of the utmost importance. Patients and their families need to feel they can safely share personal information with their healthcare providers so you receive optimal care. This is our top priority, and when we don’t meet our own high standards, we need to tell you why and what we’re doing about it,” Riendeau wrote.

CHEO confirmed that it informed nearly 300 patients and their parents that their medical information had been “briefly shared with 32 students enrolled in Algonquin College’s Faculty of Health, Policy & Public Safety and Community Studies.”

The instructor, a CHEO employee, disclosed the medical information on handouts distributed during classes on Feb. 1 and 2. The handouts listed an operating room schedule “meant as teaching resources during class time.”

The handouts were distributed “to teach future health professionals how to support surgeries in a hospital setting.” They revealed patients’ names, dates of birth, their CHEO medical registration number, their surgical procedure, their allergies, gender, age and any other pertinent information related to the surgery they were scheduled to receive at the hospital, CHEO said.

“The lists did not have: patient addresses, OHIP numbers, nor any chart notes beyond what is listed above,” the statement continued.

Algonquin informed CHEO of the privacy breaches on Feb. 17.

Riendeau told patients and their parents that CHEO believes the information “may have been seen by up to eight students before it was returned to the teacher, less than an hour after it was handed out.

“We have confirmed that all copies were returned to the instructor and have now been recovered by CHEO.”

Riendeau also told patients and parents that the students who saw the private information have been contacted and “have been reminded of the information’s confidential nature, and those interviewed by Algonquin College have confirmed that the information did not leave the classroom.”

CHEO said both it and the college did not permit the use of their medical information.

“Both organizations share a commitment to the protection of confidential information in their custody. We take this situation very seriously.”

CHEO said a “disciplinary process is underway” and that the hospital “will incorporate the learnings from this breach into future mandatory privacy training courses.”

CHEO apologized to patients and parents. “This should not have happened,” Riendeau wrote.

Both institutions have also notified the Office of the Information and Privacy Commissioner of Ontario.

CHEO did not answer questions about what the employee’s specific role is at CHEO and what sanctions the employee will face.

Algonquin, for its part, said the college “will have no comment on this issue, other than to inform you that the instructor in question is no longer at the College.”

Vaughan has contacted a lawyer to seek legal advice and has been told that others have also received similar letters from the hospital.