Ontario Health Centre Staff Address Privacy Breach Findings

A recent report from the Information and Privacy Commissioner of Ontario has revealed that staff at Maamwesying North Shore Community Health Services improperly accessed patient health records due to inadequate onboarding and privacy training for health workers in Thessalon. The investigation, led by Commissioner Francisco Woo, found that the health service provider did not implement reasonable measures to protect personal health information in its custody.

According to the report, released in July 2024, the custodian failed to ensure that proper protocols were in place to safeguard patient data. Woo noted, “I find that, at the time of the breaches, the custodian did not take steps that are reasonable in the circumstances to ensure that personal health information in their custody or control is protected.”

In response to these breaches, Maamwesying has since taken significant steps to improve its privacy practices. The organization has established a new privacy and security training policy aimed at strengthening the onboarding process for community agents. This includes regular completion of privacy training and the signing of confidentiality agreements for all new staff. Additionally, Maamwesying implemented safeguards for its electronic medical records system, such as a privacy warning and a requirement for staff to document their reasons for accessing patient charts.

The issues came to light in early April 2024 when residents of Thessalon First Nation raised concerns after a nurse allegedly accessed their private records without a legitimate reason. The community was informed of the situation through letters sent by Maamwesying, which indicated that a nurse viewed the medical records of individuals she was not caring for at the time.

The report highlighted that Maamwesying had reported the privacy breach to the Office of the Information and Privacy Commissioner of Ontario, citing violations of the Personal Health Information Protection Act, 2004. In January 2024, a considerable number of patients from Thessalon First Nation filed requests to restrict access to their health information from the community nurse involved, indicating rising concern over privacy.

Following an internal investigation, Maamwesying confirmed that the nurse had accessed patient records without authorization and disclosed sensitive information during an offsite meeting. As a result of these findings, the organization terminated the nurse’s access to electronic medical records and relieved her of her duties. “To remediate the breaches, Maamwesying adopted a new policy to improve training and onboarding for new agents, implemented safeguards for the electronic medical records system and completed initiatives to improve privacy awareness for partner communities,” Woo stated.

Despite identifying these breaches, the commission concluded that Maamwesying adequately addressed the issues by implementing corrective measures, thus no further review is necessary. The Thessalon First Nation indicated that the matter underwent thorough examination through multiple inquiries, including one by the commission, which was completed on July 17, 2024, and an independent investigation by Rubin Thomlinson that concluded on December 16, 2024.

The College of Nurses of Ontario confirmed that all health centre staff are practicing without restrictions. In a statement, Thessalon First Nation expressed satisfaction with the findings, asserting that the health centre staff did not access patient records with illegal intentions. “Leadership is satisfied that health centre staff did not snoop or review patient records with any illegal intentions. Staff accessed patient records only to provide medical services to our community members,” the release stated.

This incident underscores the importance of robust privacy measures in healthcare and the accountability of organizations in safeguarding patient information. As Maamwesying continues to implement its new policies, the focus remains on fostering a culture of privacy awareness among its staff and within the community.