Two employees breach info of 211 patients in NS

HALIFAX – Nova Scotia Health announced earlier this week that it’s in the process of contacting 211 people by letter whose personal health information was inappropriately accessed in two separate and unrelated incidents.

The provincial director of privacy for Nova Scotia Health, Karen Hornberger, told Halifax Today that an investigation was launched after a standard audit turned up a pattern of inappropriate access by two employees over the course of a two-year period.

“There was one employee from the Aberdeen Hospital in New Glasgow and there was another employee at the Valley Regional Hospital in Kentville,” Hornberger said.

“The employee in Aberdeen accessed information in one of our scheduling systems and the employee at the Valley Regional Hospital accessed information in both the scheduling system and the medical records system.”

Hornberger said affected patients will be contacted directly by letter and given more information.

“We can give them specifics around the date and time that the inappropriate access took place, the name of the person that accessed their information inappropriately and what sort of information may have been viewed by that person,” she explained.

Hornberger said the health authority’s proactive auditing program aims to stop these incidents from happening, however it isn’t always successful.

Nova Scotia Health plans to work with the Office of the Information and Privacy Commissioner for Nova Scotia to implement any additional recommendations it may have following the breaches.

Hornberger wasn’t able to go into detail on what disciplinary action will be taken against the two employees, however she did say all healthcare workers should know this behaviour will not be tolerated. “The consequences can be severe so please do not do it, it’s not worth it,” she stated. “Whatever sort of inquisitiveness you have, this is not appropriate.”

On its website, Nova Scotia Health said that staff and physicians require varying degrees of access to information to provide care to patients. The organization takes steps to ensure that all employees understand appropriate access and their obligation to keep patient information confidential, as well as to monitor access and identify inappropriate activity.

These steps include:

• Pledges of confidentiality signed by all new staff, and standard orientation regarding privacy and compliance with Nova Scotia Health policies and procedures
• Ongoing education for managers and front-line staff
• An online privacy and confidentiality learning module with the expectation all staff will complete and submit the pledge of confidentiality annually.
• Pro-active auditing capability in place and being used across the province with additional audit processes being developed.

“Nova Scotia Health takes any breach of confidentiality seriously, and thoroughly investigates potential inappropriate access. While we are extremely disappointed that these breaches have occurred, we maintain confidence in the ethical practices of employees throughout our organization.”