Paramedic’s photo reveals ‘ambiguity’ in policies, privacy watchdog says

A new single health authority, when formed, should ensure that healthcare contractors, such as ambulance companies, have formal, written policies in place to protect personal health information, says Saskatchewan’s information and privacy commissioner.

Ronald Kruzeniski made the recommendation after investigating an incident in Lloydminster in which a paramedic took a photo of a person’s injured hand and shared it with her colleagues. In a written decision, Kruzeniski said the action violated the Health Information Protection Act (HIPA) and may have occurred because of “ambiguity” in policies about collecting and sharing personal health information.

Kruzeniski recommended the Prairie North Health Authority, which oversees health care in Lloydminster, ensure proper policies are in place to make sure contractors are protecting patients’ personal health information.

“It is difficult to give recommendations to an entity that has not yet been created, but I would encourage the new single health authority to take the above recommendations into account when it enters into contracts with ambulance service companies and in developing its policies regarding transfer of personal health information,” Kruzeniski wrote.

The incident that sparked Kruzeniski’s investigation happened on Aug. 10, 2016. A female patient badly injured her hand in an accident and was taken to hospital by WPD Ambulance. While she was in the hospital, a WPD paramedic took a photo of the hand with her personal cellphone and showed it to her colleagues.

A friend of the patient complained to the ambulance company and the Prairie North Health Authority. According to Kruzeniski’s report, the paramedic who took the photo indicated that she “had not seen an injury like this before and that she wanted to use it to help improve her and her colleagues’ care if they should have to respond to a similar call in the future.”

WPD argued the photograph did not violate HIPA because the picture did not identify the injured person. Kruzeniski disagreed, noting that because the injury was unique and occurred in a smaller community, the injured person could be identified. He said WPD Ambulance’s policy is “too vague to properly instruct its employees on best practices surrounding the collection and use of personal health information” and that the contract Prairie North had with the service provider about privacy “does not have clear language about the protection or flow of personal health information.”

“The lack of a formal written protocol is troublesome from a privacy standpoint,” Kruzeniski wrote. “Further, if EMS staff are involved in the collection of personal health information, it should be clear when it is appropriate to do so and for what purpose.

“No information sharing agreement is currently in place to clarify the roles in this situation. The ambiguity in these protocols may have contributed to the paramedic’s lack of understanding about when it was appropriate for her to access the complainant and collect her personal health information (take a picture).”

According to Kruzeniski, Prairie North agreed that a formal, written protocol should be in place.