Health Sciences worker caught ‘snooping’ on hundreds of patient records in privacy breach: Shared Health

Posted on May 24, 2024 by Peggy

Hundreds of patient records were “inappropriately accessed” by a worker at Winnipeg’s Health Sciences Centre over the span of months from last summer through this spring.

Shared Health, which co-ordinates health-care delivery in the province and is responsible for operations at HSC, reported the breach Friday. It has advised about 360 patients at HSC, Manitoba’s largest hospital, that their personal health information was breached between August 2023 and March of this year, a Shared Health news release said.

The finding followed an internal investigation into “incidents of unauthorized access” of patient records by a clinical staff member, the news release said.

Patients who were affected were encouraged to contact Shared Health’s privacy office if they wanted to discuss the breach further, the organization said, and were given information on how to obtain a record of activity related to staff accessing their health records.

This isn’t the first time such a breach has happened. A paper file from HSC containing 1,000 patient records was inappropriately accessed by an employee at HSC in 2016. Weeks later, the province announced a health-care worker was caught snooping on records of about 200 patient health files.

In a statement on Friday, Shared Health’s chief privacy officer, Christina Von Schindler, called the patient privacy breach “deeply regrettable.”

Shared Health has safeguards in place to “detect inappropriate access of private patient information,” and its protocols in place to pick up on “snooping” were effective in this case, according to Von Schindler.

The clinical staff member was “held accountable for their actions” and no longer works at HSC, the statement reads.

Staff hired by Shared Health must do training on how to appropriately use or access personal health information and sign a waiver stating they will follow the Personal Health Information Act and in-house policies on confidential systems.

Shared Health says staff have to repeat that training every three years, and workers also have to undergo routine audits of their activity in the electronic health record systems.