NS privacy breach impacts more than 2,000 patients

HALIFAX – A former employee at St. Martha’s Regional Hospital, in Antigonish, N.S., inappropriately accessed the personal health information of 2,690 people, according to a news release from Nova Scotia Health. The health authority says the person responsible has been terminated and it is in the process of sending letters to those who were affected.

“Nova Scotia Health views this as a summary offence under the Personal Health Information Act and the RCMP are currently investigating,” reads the release.

“All those affected will hear directly from Nova Scotia Health and we will be available to discuss the details of these breaches with them.”

When asked what role the employee played at the hospital, Nova Scotia Health would only say it was not “clinical in nature.”

The health authority said suspicious activity was identified in September and the employee was immediately suspended. As the investigation unfolded, the employee was eventually fired in November.

Nova Scotia Health says registration, demographic and clinical information was accessed.

“While we maintain confidence in the ethical practices of employees throughout our organization, we are extremely disappointed that an employee of Nova Scotia Health would engage in activity of this nature,” reads the release.

When asked why it took so long to release this information to the public, Nova Scotia Health’s chief financial officer Derek Spinney said they needed time to figure out the scope of the breach.

“We had enough information initially to understand there was inappropriate activity,” said Spinney.

“We didn’t have a fulsome understanding of the magnitude.”

To that end, Spinney says the health authority used software to cast a net around potential breaches, and then an investigator would look at each individual record to see if there were signs it had been accessed inappropriately.

“A person would then need to investigate everyone of the thousands of records that came back to determine, was this appropriate for the work they were doing at that time, and that work takes a lot of time,” he added.

According to Nova Scotia Health, employees and physicians “have access to only that information that is required for them to perform their duties.”

If inappropriate access is suspected, the health authority says a full investigation will take place and offenders could face penalties, including fines and jail time.

In order to ensure employees understand appropriate access and the obligation to keep patient information confidential, Nova Scotia Health says the following steps are implemented:

• criminal record checks
• standard orientation for all new staff, including privacy training and compliance with Nova Scotia Health policies and procedures
• ongoing education for managers and front-line staff
• privacy and confidentiality training with the requirement for all Nova Scotia Health employees to complete and submit a signed pledge of confidentiality.
• data access controls – only those requiring access to perform their job are granted access
• continuous monitoring to detect unauthorized access attempts or suspicious activity.

At this point, no reason has been given for why the employee was accessing these records. No other employees past or present were involved in this breach, according to the health authority.

Nova Scotia Health says the Office of the Information and Privacy Commissioner for Nova Scotia have been notified.

SOURCE: CTV News