Pharmacist improperly accessed patient records

EDMONTON – A pharmacist in Edmonton, who wrongfully accessed the private health information of more than 100 patients while employed by Covenant Health, has been sentenced to three months of house arrest.

Despite not having any formal patient-pharmacist relationships with those people, Alsaadi accessed demographic information, diagnostic images, laboratory results and other health information, the Office of the Information Privacy Commissioner discovered.

Basel Alsaadi (pictured) pleaded guilty to accessing health information in contravention of the Health Information Act and received a conditional sentence, the Office of the Information and Privacy Commissioner said.

CBC News reported that Court of Queen’s Bench Justice Paul Belzil sentenced Alsaadi on Oct. 16 to three months of house arrest, with some exceptions, to be followed by three months of a court-imposed curfew. Belzil also ordered Alsaadi to perform 20 hours of community service.

“The court in these types of offences is concerned with sending a message to not only Mr. Alsaadi but any others that patient information is very important and privacy rights are extremely important in a modern society,” Belzil said, according to the OIPC news release.

A spokesperson for the Alberta College of Pharmacists (ACP) said Alsaadi is not currently on the clinical pharmacist register and is not eligible to practice pharmacy in Alberta.

He is charged with unprofessional conduct under the Health Professions Act and is going through an ACP hearing process. The hearing is expected to continue in December.

“The matters under investigation by ACP are related to those considered by the courts,” college spokesperson Barry Strader said in an emailed statement.

The case dated back to October 2014, when the privacy commissioner’s office received a breach report from Covenant Health, where Alsaadi had been employed before he resigned.

“The breach report was submitted by Covenant Health after it discovered unauthorized accesses in Alberta Netcare, the provincial electronic health record,” Scott Sibbald, a spokesperson for the Office of the Information and Privacy Commissioner, said in an emailed statement.

“Covenant Health reviewed the access or audit logs of Mr. Alsaadi in Netcare after receiving an anonymous complaint, then referred the matter to our office.”

Alsaadi worked at Covenant Health’s Grey Nuns Community Hospital and at the Cross Cancer Institute, which is operated by Alberta Health Services. He also provided health services on behalf of a number of pharmacies in and around Edmonton through Pharmaclinix Inc., Sibbald said.

The OIPC investigation found that 104 individuals were affected by Alsaadi’s unauthorized accesses.

The findings were referred to Crown prosecutors with Alberta Justice. Charges were laid in February 2016. Affected individuals were notified

In a statement, Covenant Health said that when it became aware of the privacy breach in 2014, it “immediately opened an investigation and took steps to protect electronic health information and suspend access.”

Covenant Health notified OIPC and the Alberta College of Pharmacists and worked collaboratively with both throughout the investigation, it said.

“We notified the individuals whose records were inappropriately accessed and provided information, guidance and advice as needed,” the statement said.

“Covenant Health has taken steps to improve practice, including updating and expanding privacy training for Covenant Health team members, improving reporting processes and enhancing communications about privacy of health information.”

Alsaadi’s conviction is the eighth since the Health Information Act was enacted in 2001. One other case is before the courts.