Inappropriate access incidents prompt patient notifications

CALGARY – Following the conclusion of a privacy investigation, Alberta Health Services (AHS) is notifying 178 Albertans that their health information was inappropriately accessed by a former AHS administrative employee.

These notifications were mailed to the affected individuals on October 24, 2018, in accordance with the Health Information Act. Only those individuals who receive letters were subjects of this breach.

The inappropriate access incidents took place from February to July of this year at Calgary’s Richmond Road Diagnostic and Treatment Centre and occurred in Alberta Netcare (provincial electronic health record system) and AHS’ Calgary Zone Clinibase system (this system manages referrals, waitlists, pre-admissions/pre-registrations, admissions/registrations, bed management, transferring/discharging of patients). These inappropriate access incidents did not impact patient care or the accuracy of patient records.

“This privacy breach is unacceptable and disappointing, especially given the extensive work AHS has done over the past several years to build awareness and understanding among staff of the importance of appropriately collecting, using, disclosing and protecting their health information,” says Todd Gilchrist, Vice President, People, Legal & Privacy.

“Albertans trust us to safeguard their health and personal information. Moreover, all AHS staff are required to act in accordance with Alberta’s privacy legislation, as well as AHS’ privacy and security policies. As an organization that holds accountability for ensuring the health records of Albertans are never inappropriately accessed, we will be further enhancing our efforts to reinforce the importance of appropriate access and safeguarding patient information,” says Gilchrist.

AHS was first alerted to the potential inappropriate access incidents through a proactive Netcare audit supplied by Alberta Health. A review of this audit by site management, and subsequent followup audits of AHS’ Clinibase system, confirmed multiple inappropriate accesses to diagnostic, treatment and care information had occurred.

A thorough investigation was completed by AHS and the employee is no longer with the organization. The matter was also reported to Alberta Health and the Office of the Information & Privacy Commissioner of Alberta (OIPC). AHS will work cooperatively with the OIPC in any investigation their office may decide to initiate into the matter.

Alberta Health Services is the provincial health authority responsible for planning and delivering health supports and services for more than four million adults and children living in Alberta. Its mission is to provide a patient-focused, quality health system that is accessible and sustainable for all Albertans.

- 30 -