Office of the Information and Privacy Commissioner
September 11, 2014
Sentence Handed Down in Personal Health Information Act Matter
On September 11, 2014, Provincial Court Judge Kymil Howe handed down a fine of $5,000 following a guilty plea previously entered by former Western Health employee Donna Colbourne.
Several months ago, Ms. Colbourne pled guilty to a charge at Provincial Court in Corner Brook in which she acknowledged that on 75 occasions between April 20, 2012, and May 14, 2012, she illegally accessed patient information for purposes unrelated to her job function in contravention of section 88(1) of the Personal Health Information Act, also known as PHIA [pronounced “fee-ah”].
The agreed statement of facts outlines that Ms. Colbourne’s computer access did not include doctor’s or laboratory reports, nurse’s notes, or detailed medical records. Ms. Colbourne did, however, have access to information about the date and billing code for each patient visit. In some cases the billing code for the visit could include sensitive personal health information; specifically it could include the reason for the visit. She also had full access to all patient names, addresses, billing information, dates of birth, MCP numbers, next of kin, emergency contact information and marital status information. Ms. Colbourne was not allowed to access this information for any purpose other than fulfilling her job functions, however she admitted to accessing such information for reasons other than fulfilling her job functions on 75 occasions within a span of less than one month.
Western Health notified all individuals who were affected by these breaches and responded to inquiries they received from those individuals with respect to the information inappropriately accessed by Ms. Colbourne. In addition, Western Health was obligated, under the provisions of the Personal Health Information Act, to inform the Province’s Information and Privacy Commissioner of the breach. The Office of the Information and Privacy Commissioner received a number of complaints from affected individuals and conducted an investigation into the matter, as a result of which the charge was laid against Ms. Colbourne. Ms. Colbourne was removed from her position as an Accountant I with Western Health on May 14, 2012.
This is the first conviction entered under the Personal Health Information Act. One other person has been charged with an offence under the Act, and that matter is still before the courts.
Commissioner Ed Ring issued the following comment in relation to the sentencing today: “I believe justice has been served today and that the Court has recognized the seriousness of this offence. When patients receive treatment by Regional Health Authorities, health professionals, or any custodian of personal health information, they expect their information to be handled in accordance with the law. As Commissioner responsible for overseeing the Personal Health Information Act, I want to assure Newfoundlanders and Labradorians that we will hold any individual or organization accountable in circumstances such as these, to the point of laying a charge in Provincial Court if and when appropriate.”
The Office of the Information and Privacy Commissioner is an independent Office of the House of Assembly which oversees compliance of the Personal Health Information Act (PHIA) and the Access to Information and Protection of Privacy Act (ATIPPA).
- 30 -
Media contact:
Ed Ring
Information and Privacy Commissioner
709-729-6309
ering@oipc.nl.ca
2014 09 11 4:10 p.m.