SHORTFALL IN TAXREVENUE
Assessed values downtown are plunging
The health records of 178 patients were wrongly accessed by an Alberta Health Services staffer, the AHS said Friday.
The privacy breach occurred from February to July this year at Calgary’s Richmond Road Diagnostic and Treatment Centre, the AHS’s Calgary Zone Clinibase system and the Alberta Netcare records system, they said.
Data accessed by the staff member employed at the Richmond Road centre included treatment, diagnostic and care information.
Parent care and data accuracy weren’t affected by the violations, said AHS officials, adding patients whose records were accessed are being notified this week.
“This privacy breach is unacceptable and disappointing, especially given the extensive work AHS has done over the past several years to build awareness and understanding among staff of the importance of appropriately collecting, using, disclosing and protecting their health information,” said Todd Gilchrist, the AHS’s vice-president people, legal and privacy.
“It’s something we take very seriously. Albertans trust us to provide care, protect their privacy and secure this information.”
The breaches were detected early this month by a Netcare audit that led to a review of the Clinibase system, he said.
They’ve been reported to Alberta Health and the Office of the Information and Privacy Commissioner.
Following that discovery, the person responsible was dismissed, said Gilchrist.
“I don’t want to pre-suppose the actions the OIPC might take, but there could be fines,” he said, adding the person’s motivation is unclear.
“I don’t really want to speculate, but it seemed to be for personal reasons.”
The AHS will re-emphasize through staff training the need for information privacy while pursuing advanced auditing techniques and tools, said Gilchrist.
Last November, OIPC determined AHS failed to properly employ safeguards when 49 staff members improperly accessed information on a patient and her daughter at Calgary ’s South Health Campus in 2015.
But it said AHS conducted its investigation properly and thoroughly.
In 2014, AHS admitted it was aware for months that one of its employees at the Alberta Children’s Hospital was snooping through private patient records before plugging that privacy breach that occurred in 2013-2104.
And OIPC found AHS employees breached privacy rules by using cellphones and personal email to transmit sensitive information outside a secure network after a power outage knocked out computer servers in 2012.