A Prince Albert health clinic has reviewed its policies and procedures after the Office of the Saskatchewan Information and Privacy Commissioner found a patient’s privacy had been violated last year.
According to the ruling, issued on March 27 of this year, a patient attending the clinic last August had her pregnancy proclaimed to the public on social media by a Cooperative Health Centre Community Clinic employee.
The patient and her spouse attended the clinic for lab services in relation to her pregnancy. After going to the clinic, the spouse was notified of a social media post that said he had gotten someone pregnant. He and the patient contacted the clinic to advise that their medical information had been disclosed outside the clinic.
In September, the clinic contacted the privacy commissioner’s office. The clinic said it intended to conduct an investigation and meet with the patient and her spouse to obtain details about the complaint.
In its own investigation, the clinic determined a breach had not occurred. The clinic said the staff member who made the social media post knew the patient and her spouse, and the information about the pregnancy could have come from another source.
The employee also alleged the spouse had threatened to get her fired if she told anyone about the pregnancy.
The information and privacy commissioner disagreed with the conclusion that a breach had not occurred.
“Regardless of whether the employee could have also learned the patient was pregnant through sources outside of the clinic, it has been confirmed the employee would have known of the patient’s pregnancy from her employment with the clinic,” the official report into the incident read.
“It is an inappropriate practice for employees to post information that they would have knowledge of based on their employment with the (clinic). Based on the social media post, I would conclude that a patient’s personal health information was inappropriately disclosed as it is reasonable that the patient would be identifiable; therefore, a privacy breach has occurred.”
The commissioner’s office also addressed an allegation by the spouse that the employee made comments about his impregnating of “another woman” and another comment of a personal nature. The report into the incident found that those personal comments also constitute a privacy breach.
The report recommended the clinic complete its investigation by interviewing the employee to gain more details and prevent future occurrences. It also recommended the employee stops making social media posts and personal comments regarding personal health information, as well as recommending the employee face disciplinary action.
The commissioner did commend the health clinic for reviewing its internal policies and procedures to create a comprehensive privacy manual. He recommended the clinic ensure its manual include policies surrounding the use of social media by employees.
Following the incident, the clinic met with lab staff to review privacy policies and review the protections in place. It also provided all employees with a letter of expectation to remind them of their obligation to protect personal health information.
When reached by phone, health clinic executive director Renee Danylczuk indicated the clinic was “disappointed” the incident took place, but accepted the commissioner’s recommendations and was working towards addressing them and putting them into practice.
She said the clinic has reviewed its policy and is in the process of adopting a social media policy. She said the incident did provide an opportunity to prevent future privacy breaches in the future.
According to Danylczuk, the clinic has reached out to the patient and her spouse, and they are satisfied that the issue has been properly resolved.
