Nov 27, 2001

The Manitoba Ombudsman's Office has completed an investigation into several allegations of breach of personal health information privacy made by a patient of Winnipeg's Health Sciences Centre (HSC), a trustee under The Personal Health Information Act.

Barry Tuckett, the Manitoba Ombudsman, found that one complaint, relating to inappropriate changes to the patient's demographic information (personal health information in this context), was substantiated; however, it could not conclusively be established that the complainant did not participate in the incident together with an HSC employee who had been her friend. The Ombudsman was of the opinion that other allegations made by the complainant were not substantiated.

Mr. Tuckett stated: "The complainant's public allegations brought into question the integrity of records management in the largest health care facility in Manitoba, making this a matter of public interest."

The investigation was launched after a complaint was made to the Manitoba Ombudsman and the media reported that an employee of the HSC had tampered with and disclosed the complainant's personal health information. The complaints investigated by the Ombudsman's Office were as follows:

• that an employee of the HSC allegedly tampered with (altered) the complainant's personal health information;
• that the employee allegedly mailed copies of the complainant's altered personal health information to twelve of the complainant's friends and relatives;
• that the employee allegedly mailed a letter containing the complainant's personal health information to two of the complainant's friends; and
• that, with respect to concerns raised by the complainant with the HSC about these allegations, the facility did not: a) take her concerns seriously, b) report the findings of its investigation to her and c) provide her with a copy of her restored personal health information.

The complainant also expressed concern that the HSC did not take safeguards to ensure that personal health information held at the facility was secure. A review of the facility's compliance with the security safeguard provisions of The Personal Health Information Act is the subject of a separate investigation opened by the Ombudsman.

After her initial contact with the Ombudsman's Office, the complainant ceased to cooperate with investigators. Specifically, she failed to provide information that was required to investigate fully the allegations she made. Nevertheless, these allegations were very serious and the Ombudsman was not prepared to discontinue the investigation. After repeated attempts to obtain the complainant's cooperation, a subpoena was issued to her pursuant to the powers of the Ombudsman under The Personal Health Information Act and The Manitoba Evidence Act requiring her to answer questions relating to the matter.

The Ombudsman's report, dated November 14, 2001, concluded that:

• While the Ombudsman's investigation supported that an employee had changed the complainant's demographic information, the circumstances are in dispute. The employee's version is that the changes were made in the complainant's presence as a joke, with a copy being provided to her, following which the records were put back to their original wording. The complainant denied any involvement in the matter. On balance, the investigation supports the employee's version of the event.
• The investigation found no substance to the complaint that the HSC employee mailed copies of the complainant's electronic demographic data to twelve of the complainant's friends and relatives.
• The investigation found no substance to the complaint that the HSC employee mailed a copy of a letter referring to the complainant's surgery to two of the complainant's friends.

The investigation found that the HSC took the matter seriously, conducted an investigation, and took what appears to be appropriate action. While the HSC did not report its findings to the complainant, the HSC is giving consideration to incorporating such reporting into its facility practices. In addition, the complainant's personal health information records at the HSC were available for her to review upon request.

"The HSC, as a trustee under The Personal Health Information Act, is responsible for the integrity of the records it maintains. Employees of the trustee who undertake responsibilities for the maintenance of personal health information are deemed to be acting on behalf of the trustee."

"In the circumstances of this case, my opinion is that the HSC had taken reasonable steps as a trustee to protect the personal health information it maintained," said Tuckett. "The facility also has a system in place to monitor changes made to electronic records which substantiated that personal health information in this case had been altered inappropriately."

Created in 1970, the Office of the Manitoba Ombudsman exists to promote fairness, equity and administrative accountability through independent and impartial investigation of complaints and compliance reviews. An Access and Privacy Division was established in 1998 to investigate complaints and review compliance under The Freedom of Information and Protection of Privacy Act and The Personal Health Information Act.