SHA working to establish patient privacy standards

SASKATOON The Saskatchewan Health Authority says it is working to ensure all staff have standardized privacy training by the end of March 2021, and that more than half have been trained since the process began last fall.

The health authority’s privacy protections most recently came under scrutiny in a Dec. 6 report by Saskatchewan’s Information and Privacy Commissioner, Ron Kruzeniski, which looked at breaches involving 59 patients’ health information when continuing-care-aide patient visit schedules were either lost or stolen in Saskatoon and Regina between September 2018 and June 2019.

The schedules included information about the patients’ health status, the type of care they required and, in at least one case, how to gain access to the patient’s home.

In three incidents, the care aides’ vehicles were broken into and the schedules were stolen while the aide was either at home or visiting a patient. In a fourth incident, a page from a schedule was found in a parking lot, Kruzeniski wrote.

Two additional incidents occurred before the amalgamation of the health regions in December 2017, involving the information of 21 patients.

Kruzeniski found that procedures for handling the schedules weren’t consistent between Saskatoon and Regina. The health authority hadn’t provided him with information about safeguards used in other parts of the province. In one incident, 20 shifts’ worth of schedules were involved; another involved a month’s worth of schedules, despite a policy requiring staff to shred the day’s schedule at the end of each shift.

Kruzeniski learned that the Regina office started a compliance monitoring process last October, but the health authority did not provide information when he asked if this was also done elsewhere.

“As breaches continue to occur, I find that the SHA is not doing enough to ensure the protection of the schedules,” Kruzeniski wrote.

He called on the province to standardize its approach to policy on the continuing-care aides’ handling of patient schedules.

SHA spokeswoman Amanda Purcell said in an emailed statement that there are various policies across the province for the homecare department regarding protection of personal health information, and these policies vary by former health region.

“As part of our transition into Saskatchewan Health Authority, any regional-based policies will be reviewed and revamped to create new provincial-scope policies. This provides us with an opportunity to take best practices from various areas of the province and implement them in other areas, to further improve services,” she wrote.