Personal information of 3 QEH patients compromised by employee: P.E.I. Privacy Commissioner

An employee at Charlottetown's Queen Elizabeth Hospital inappropriately accessed the private health information of three patients, according to a new report publishedby P.E.I.'s Information andPrivacy Commissioner.

Commissioner Karen Rose's reporton the privacy breach and how it was handled followsa complaint last summer to Health PEIby one of the patients, and a subsequent audit and investigation by the agency.

"Health PEI's audit ... confirmed that the employee accessed electronic medical records of three individuals, and that the access was not necessary for the employee's job," Rose wrote in her report.

'To find their room numbers'

According to the report, days after the complaint came in last JulyHealth PEI metwith the employee, who worksat the hospitalbut is not authorizedto access patients' electronic charts including accessing them to look up hospital room numbers.

Those charts include information like patient demographics, test resultsand medication.

Such invasions of patient privacy inevitably lead to loss of trust in health care providers. Karen Rose,

The employee explained theyknew all three patients two of whom were family members and that they only accessed the charts "to find out their room numbers to visit them."

According to the commissioner's report, Health PEI accepted that explanation, and determinedtheemployee did not publicly disclose any of the patients' personal health information to anyone else.

The agency ultimately allowed the employee to return to work under a performance management plan.That includes further training, regular auditsand a requirement that the employee "not process the complainant'spersonal health information in the future."

'Reasonable measures'

In her report, Rose concluded Health PEI"adequately investigated" the privacy breach, and has taken "reasonable measures" to prevent further breachesby the employee.

"Health PEI demonstrated that it understands the serious consequences of unauthorized access to patients' electronic health records," Rose wrote.

"Such invasions of patient privacy inevitably lead to loss of trust in health care providers, and in the health care system."

In her report Roserecommended Health PEI remind all users that electronic medical records are not be accessed for reasons unrelated to their employment duties.

Larger QEHbreach still under review

The commissioner and Health PEI continueto investigate a much larger privacy breach by a former QEH employee.

The agency revealed last fall the former employee had accessed 353 patient files in breach of hospital privacy rules.

Health PEI launched a review of the incident, partly to seehow policies and procedures could be improved.

Rose saidthe privacy commission's own report on that case will likely be published by early September.

More P.E.I. news