“Not as a matter of course … The college would report matters to the police or IPC (information and privacy commissioner) on a case-by-case basis, based on what risk the matter poses to public safety,” Bill Clarke, spokesperson for the College of Nurses of Ontario, explained in an email.
Over the past two weeks, two nurses have faced college disciplinary hearings, accused of peering into patient files without authorization. Their cases are among many on which the Star has recently reported.
Violations of health information privacy appear to be a growing problem in the age of electronic records. It has never been easier to access personal records, when a single computer can allow authorized staff to probe a whole database of patient information.
Only staff directly involved in care are supposed to be able to access a patient’s medical files. Anyone accused of snooping may face disciplinary action by the employer or regulatory body, as well as an investigation by the provincial Information and Privacy Commissioner.
Despite this, there has never been a single conviction under the provincial privacy legislation, known as the Personal Health Information Privacy and Access Act, since it came into effect over a decade ago.
The Office of the Information and Privacy Commissioner of Ontario does not have authority to launch prosecutions. Only the attorney general can do so — and only if police investigate and confirm the law has been broken.
However, it appears such cases are rarely reported to police.
Alberta, Manitoba and Newfoundland and Labrador — the only provinces that have had successful prosecutions under health privacy laws — do not require police to duplicate the commissioner’s investigations.
There is also a statutory six-month deadline for prosecutions in Ontario, which requires that the hospital, privacy commissioner and police investigations all be completed within six months.
The week before, nurse Mandy Edgerton-Reid appeared for a disciplinary hearing on allegations that she looked into the medical records of about 300 patients at the Peterborough Regional Health Centre. But the case was adjourned until mid-June, when her lawyer is scheduled to argue that the public and media should be barred from the hearing.
“A privacy breach is not reportable to the police,” said Sault Area Hospital spokesperson Rose Calibani.
Jason Gennaro, a spokesperson for the attorney general’s minister, previously told the Star that any member of the public can report a health privacy breach to police.
With files by Olivia Carville