Patient details faxed to computer store, again

The Saskatoon Regional Health Authority has for the second time this year faxed confidential patient information to a computer store in North Battleford, according to a new report from Saskatchewan’s privacy czar.

The latest incident happened last month and resulted in Kelly’s Computer Works receiving a fax containing a patient’s name, health card number and cardiac test results, Information and Privacy Commissioner Ron Kruzeniski wrote in the report published earlier this month.

It happened nine months after the first “misdirected fax” ended up at the computer store, Kruzeniski noted in the report, adding that both faxes were intended for the same physician and the first incident was resolved “informally.”

After investigating the second incident, the privacy commissioner concluded that the faxes were sent by different medical office assistants, both of whom had incorrectly recorded the physician’s fax number. He said the SRHA adequately contained the breach.

“As this issue appears to be a reoccurring issue, my office asked SRHA to explore options to block outgoing fax numbers from either the fax machine or through its telecommunication service provider,” Kruzeniski said in the report.

“My hope was for SRHA to find a way to block the computer company’s fax number to prevent personal health information from being incorrectly faxed to that number,” but it was not able to do so, the privacy commissioner added.

Kruzeniski concluded that the health region’s faxing practices do not follow its internal policies, and recommended that all of its employees take a mandatory annual privacy training course.

The health region responded by saying it will be difficult, given that it is in the process of amalgamating into the new Saskatchewan Health Authority, which will replace the province’s 12 health regions this year, according to the report.

“I am hopeful that SRHA and its staff will encourage and promote mandatory privacy training and the new Saskatchewan Health Authority will adopt a policy of mandatory annual privacy training for all employees,” Kruzeniski said in the report.

I am hopeful that SRHA and its staff will encourage and promote mandatory privacy training.