B.C. health workers breached privacy of injured victims of Vancouver festival attack

Source Domain: ca.style.yahoo.com

VICTORIA — British Columbia health care workers unlawfully accessed highly sensitive personal information on victims of Vancouver’s Lapu Lapu Day festival attack mostly out of “curiosity,” the province’s privacy commission says.

A report released by the Office of the Information and Privacy Commissioner said it was notified of privacy breaches within days of the deadly attack, and an investigation found 71 instances of unlawful “snooping” on 16 victims’ medical records.

The report found 35 workers at B.C. health authorities engaged in the snooping, as well as one worker at a doctor’s office who had access to Fraser Health’s electronic medical records system.

All the employees who were implicated in the snooping incidents were disciplined by their employers, including some who were terminated, although the report said most received suspensions, while some were sent “letters of expectation.”

Privacy commission Michael Harvey’s office said its investigation found the breaches violated the Freedom of Information and Protection of Privacy Act, which prohibits an employee of a service provider from collecting, using or disclosing personal information, except as authorized by the legislation.

Harvey’s office also found that individuals whose privacy was breached weren’t notified without unreasonable delay, and the health authorities believed they weren’t required to notify affected individuals.

“Vancouver Coastal Health and [the Provincial Health Services Authority], after assessing the risk of harm to individuals whose privacy was violated, initially took the position that notification was not required and could itself result in further harm,” the report said.

The authorities, the report said, took the view that notifying people could result in “re-traumatizing or re-victimizing them.”

The investigation also found the health authorities had “reasonable safeguards” in place to prevent and respond to breaches, and they took steps after realizing patients’ privacy was at risk,…

Source