Health Centre Staff Accessed Records, No Illegal Intent Found

Staff at Maamwesying North Shore Community Health Services accessed patient health records inappropriately, but did not act with illegal intentions. This conclusion comes from a report released by the Information and Privacy Commissioner of Ontario, which pointed out that the organization failed to implement adequate privacy training and onboarding for health workers in Thessalon.

Investigator Francisco Woo stated, “I find that, at the time of the breaches, the custodian (Maamwesying) did not take steps that are reasonable in the circumstances to ensure that personal health information in their custody or control is protected.” The report, issued in July 2024, identified significant gaps in privacy management within the organization.

In response to these breaches, Maamwesying has since taken corrective measures. The organization developed a new privacy and security training policy, which enhances and formalizes the onboarding process for community health agents. Regular completion of privacy training and confidentiality agreements has also been mandated. In addition, safeguards for electronic medical records have been strengthened, including the introduction of a privacy warning and a requirement for users to document their reasons for accessing patient charts.

The report addressed a serious incident reported in early April 2024, when residents of Thessalon First Nation expressed concerns about a community nurse allegedly accessing their medical records without a legitimate reason. Residents received letters from Maamwesying, informing them of the potential privacy breach. The chief privacy officer of Maamwesying indicated that the nurse accessed records of individuals to whom she was not providing care at the time.

According to the report, Maamwesying reported this incident to the Office of the Information and Privacy Commissioner of Ontario under the Personal Health Information Protection Act, 2004. At that time, Maamwesying was working in partnership with the community to deliver healthcare services at a local health centre.

In January 2024, a significant number of patients requested to restrict access to their health records from the nurse involved. This type of request is known as a health-care lockbox request. Following an internal investigation, Maamwesying confirmed that the nurse had viewed patient records without authorization, and further revealed that she disclosed patients’ personal information during an offsite meeting with other staff members.

“Following its investigation into the matter, Maamwesying found that the nurse viewed patients’ health records without authorization. The custodian removed her access to all electronic medical records and relieved her of her duties,” Woo reported. To address the breaches, Maamwesying implemented a new policy aimed at improving training and onboarding for new agents and introduced additional safeguards for its electronic medical records system.

The commission’s findings indicated that Maamwesying did not have reasonable measures in place to protect personal health information from unauthorized access, as required by law. Despite these shortcomings at the time of the breaches, the commission concluded that Maamwesying responded adequately to the situation and deemed further review unnecessary.

The leadership of Thessalon First Nation stated that the matter underwent comprehensive investigations by three separate inquiries, including the commission’s review completed on July 17, 2024, and an external independent investigation conducted by the firm Rubin Thomlinson, which was finalized on December 16, 2024. The College of Nurses of Ontario also conducted a review.

According to the online registry of the College of Nurses of Ontario, all health centre staff currently practice with no restrictions. The leadership of the Thessalon First Nation expressed satisfaction with the investigations, stating that their health centre staff did not access patient records with any illegal intentions. They emphasized that staff accessed records solely to provide essential medical services to the community.