Edmonton pharmacist pleads guilty to accessing 104 patients' medical records

An Edmonton pharmacist who wrongfully accessed the private health information of more than 100 patients while employed by Covenant Health has been sentenced to three months of house arrest.

Basel Alsaadi pleaded guilty to accessing health information in contravention of the Health Information Act and received a conditional sentence, theOffice of the Information and Privacy Commissioner said Wednesday.

• Former Alberta Health Services employee fined $3,000 for breaching client files
• AHS privacy breach 'troubling,' says digital security expert

Court of Queen's Bench Justice Paul Belzilsentenced Alsaadion Oct. 16 to three months of house arrest, with some exceptions, to be followed by three months of a court-imposed curfew. Belzilalso ordered Alsaadi to perform 20 hours of community service.

"The court in these types of offences is concerned with sending a message to not only Mr.Alsaadi but any others that patient information is very important and privacy rights are extremely important in a modern society,"Belzilsaid, according to the OIPC news release.

A spokesperson for the Alberta College of Pharmacists (ACP) said Alsaadi is not currently on the clinical pharmacist register and is not eligible to practise pharmacy in Alberta.

Heis charged with unprofessional conduct under the Health Professions Act and is going through an ACP hearing process. The hearing is expected to continue in December.

"The matters under investigation byACPare related to those considered by the courts," collegespokesperson BarryStradersaid in an emailed statement.

The case dated back to October 2014, when the privacy commissioner's officereceived a breach reportfrom Covenant Health, where Alsaadihad been employed before he resigned.

"The breach report was submitted by Covenant Health after it discovered unauthorized accesses in Alberta Netcare, the provincial electronic health record," Scott Sibbald, a spokesperson for the Office of the Information and Privacy Commissioner, said in an emailed statement.

"Covenant Health reviewed the access or audit logs of Mr. Alsaadi in Netcare after receiving an anonymous complaint, then referred the matter to our office."

Worked at Grey Nuns, Cross Cancer Institute

Alsaadiworked at Covenant Health's Grey Nuns Community Hospital and at the Cross Cancer Institute, which is operated by Alberta Health Services.Healso provided health services on behalf of a number of pharmacies in and around Edmonton through Pharmaclinix Inc., Sibbald said.

The OIPC investigation found that 104 individuals were affected by Alsaadi's unauthorized accesses.

Despite not having any formal patient-pharmacist relationships with those people, Alsaadiaccessed demographic information, diagnostic images, laboratory results and other health information, OIPC discovered.

The findings were referred to Crown prosecutors with Alberta Justice. Chargeswere laid in February 2016.

Affected individuals were notified

In a statement, Covenant Health said that when it became aware of the privacy breach in 2014, it "immediately opened an investigation and took steps to protect electronic health information and suspend access."

Covenant Health notified OIPC and the Alberta College of Pharmacists and worked collaboratively with both throughout the investigation, it said.

"We notified the individuals whose records were inappropriately accessed and provided information, guidance and advice as needed," the statement said.

"Covenant Health has taken steps to improve practice, including updating and expanding privacy training for Covenant Health team members, improving reporting processes and enhancing communications about privacy of health information."

Alsaadi's conviction is the eighth since the Health Information Act was enacted in 2001. One other case isbefore the courts.