Records of forty patients affected by privacy breach, CKHA says

The confidential records of approximately 40 patients were accessed earlier this year by a Chatham-kent Health Alliance employee who’s no longer with the hospital.

During a conference call with media Wednesday, president and CEO Lori Marshall refused to say if the “regulated health professional” was fired or resigned after the privacy breach was discovered.

Marshall would not disclose the former employee’s job, but he or she is not a doctor because physicians are not considered CKHA employees.

There was no pattern to the electronic records accessed, said a CKHA news release.

“I can’t say what would compel anyone to do this,” Marshall said. “We have determined that this was a case of random snooping due to curiosity.”

The records were not printed or copied, she said.

The privacy breach was noticed during a routine audit in May. An investigation found the employee had improperly accessed dozens of records since March.

“It’s probably something that we discover maybe once a year, that there has been some form of a breach or other,” Marshall said. “In this case, given the number of patients that were involved we felt that this was an important one that we wanted to make sure that the public was aware.”

All patients whose records were accessed are being notified. They’re invited to speak with the CKHA privacy officer.

The breach was also reported to the ex-employee’s professional college and to the Information and Privacy Commissioner of Ontario, Marshall said.

As for a police investigation, “that would not be my expectation,” she said.

A Chatham-kent police spokesperson could not be reached for comment.

Employees and doctors are only permitted to access records of patients under their care, Marshall said. Audits look for violations.

“When every individual joins the organization, they do receive training and everyone signs a privacy agreement upon their hire at

Chatham-kent Health Alliance,” Marshall said. “On an annual basis, each person is tasked with completing mandatory privacy electronic learning.”

The health alliance, along with partners in Windsor and Leamington, is scheduled to implement a new electronic record system in November.

The upgrade has been in the works for “a number of years” and is not related to this latest breach, Marshall said.

“Our current system is, I would say, quite archaic and is really in need of replacement,” she said. “The new system will have much greater auditing capabilities.”

The new system will also allow for more limits on accessing patients’ records.