Investigation Report: PHIA Privacy Breach Southern Health-Santé Sud

2024-12-31

Summary

Report with Recommendations & the Response to the Recommendations In March of 2020, Southern Health-Sante Sud regional health authority (the RHA) became aware of a privacy breach where a privacy officer was accessing personal health information (PHI) of a third party without authorization. The RHA regional privacy officer reported the privacy breach to our office, and we also received complaints from two individuals who alleged that their PHI was accessed inappropriately. Our office investigated the complaints and determined that the use of the complainants’ PHI was not authorized. Our office also reviewed policies, procedures and other information provided by the RHA and found that it had not met the security requirements and standards for the protection of personal health information set out under The Personal Health Information Act. Our office is therefore making recommendations to the RHA to address the issues identified during our investigation.

Case MO-0154-202-0251