Investigation Report – PHIA – Unauthorized Collection, Use, Disclosure and Security of Information – Medical Clinic in Winnipeg
investigations & monitoring
body or trustee
Summary
In January of 2022, a privacy complaint was received by our office in relation to an employee of a Winnipeg-based medical clinic accessing personal health information (PHI) without authorization.
Our office investigated the complaint and determined that the employee created falsified medical records of the complainant for the purpose of being able to access linked records in another system, and that the collection, use and disclosure of the complainant’s PHI was not authorized. Therefore, the complaint is supported.
Our office initiated a prosecution of the employee under The Personal Health Information Act (PHIA). The employee pleaded guilty to unauthorized use of the complainant’s PHI.
The employee’s employment with the clinic was terminated during this investigation. We are satisfied that the clinic appropriately addressed the privacy breach.
Case MO-00303