The Star Phoenix reports:
An employee has been terminated and roughly 900 patients are being notified following a privacy breach in Saskatchewan’s Heartland Health Region.
According to a news release issued Thursday, a “detailed inquiry” was launched after the breach was reported in July.
It found one employee inappropriately accessed personal health information of patients through charts that were stored in an electronic record system over a 14-month period.
Read more on The Star Phoenix.
Heartland Health Region issued the following statement today:
Privacy Breach Being Addressed in Heartland In July 2015 an alleged breach of privacy was reported in Heartland Health Region. The region immediately launched a detailed inquiry to determine the facts of the situation. The investigation revealed that over a 14-month period, one employee inappropriately accessed personal health information of approximately 900 patient charts stored in an electronic medical record system. This constitutes a breach of privacy under the Health Information Protection Act.Greg Cummings, President and CEO for the Heartland Health Region stated, “The privacy of personal health information is something we take very seriously and we extend our sincere apologies to those patients affected by this breach.”
As a result of this situation, the following actions have been taken by the Health Region:
- The employee has been terminated and the employee’s professional association has been notified of this action.
- A letter has been mailed to all affected patients explaining the breach and the region’s follow up actions.
- The Office of the Saskatchewan Information and Privacy Commissioner, the Ministry of Health and eHealth Saskatchewan have been informed of the breach.
Additional corrective actions that the region will undertake include:
- Reviewing and limiting access to ensure the security and safety of personal health information;
- Reviewing internal approval and authorization processes when new electronic systems are implemented;
- Reviewing existing provincial privacy impact assessments and/or implementing regional privacy impact assessments as necessary;
- Developing a process to regularly audit and monitor all electronic systems; and
- Reviewing staff education related to confidentiality and the privacy and protection of personal health information.
We are confident that the steps underway will reduce the risk of such an incident occurring in the future.