Class action proposed in hospital privacy breach
A class action is being launched against the Nova Scotia Health Authority over a privacy breach at St. Martha’s Regional Hospital in Antigonish.
Halifax-based Wagners Law Firm filed a statement of claim with the Supreme Court of Nova Scotia on Tuesday.
The proposed class action stems from the inappropriate accessing of personal health information by a clerical worker at St. Martha’s between May and September 2023.
In total, 2,690 people had their personal health records accessed.
“We’re alleging that the (NSHA) should have intercepted the activity earlier, or someone around the employee should have alerted (managers) earlier or education efforts should have reinforced for that employee that what she was doing was inappropriate and that there are serious consequences,” Maddy Carter, a lawyer at Wagners, told The Chronicle Herald on Tuesday.
“There are a wide variety of ways this could and should have been caught a lot earlier thereby mitigating the scope and severity of this privacy breach.”
According to an April 19 news release from the NSHA that announces the breach, the inappropriately accessed records included “registration, demographic and clinical information.”
The employee was fired and the matter referred to the RCMP, who are investigating.
“Nova Scotia Health will not tolerate any unauthorized access or snooping,” reads the April 19 statement.
“Any suspicion of inappropriate access will be fully investigated and we will pursue the full force of any and all penalties available to us against offenders without hesitation, including fines and jail time where possible.”
A request for comment on the lawsuit to the NSHA made Tuesday afternoon had not received a response by 4 p.m.
The employee was caught due to an audit of records done in November 2023 by the NSHA.
Carter said she is of the understanding that the audit resulted from another employee raising the alarm at the hospital.
The lawsuit lists Antigonish resident Sharlene Peters as a plaintiff. However, if approved by the court as a class action, then it will automatically include all people who were victims of the privacy breach.
Those wishing to pursue their own legal remedies would have to opt out of the suit.
Wagners is encouraging people who receive letters from the health authority notifying them that their personal information was inappropriately accessed to contact the firm.
“Some of those people will provide affidavits and those will be used at the certification hearing to show their experience with the privacy breach and the impacts it’s had on them,” said Carter.
“For the vast majority who have been impacted, the beauty is that they don’t have to do a whole lot. They can have access to justice and participate in a relatively passive way. That’s even more vital in a case like this with a privacy breach where a lot of people wouldn’t want to come forward.”
Wagners does not list an amount that it is suing for and a payout would be contingent on a settlement agreement or a victory in court.
“I do believe this is the largest-scale privacy breach whereby one individual was responsible for breaching the records of so many,” said Carter.
“If you assume that the former employee spent even just one minute looking at the records of 2,690 patients, that works out to 44 hours. How that wasn’t caught is hard to fathom.”
Cpl. Guillaume Tremblay said that the RCMP continues to investigate the breach and it’s too early to say whether charges will be laid.
“If someone from the public believes their information is being used to commit criminal offences, suspect fraud or identity theft, please contact police to report the incident,” said Tremblay.
“We also suggest those individuals to contact credit monitoring bureaus such as Equifax and TransUnion.”
In its letter to those affected by the breach, the NSHA is offering to pay for the cost of credit monitoring.