"In the old days, three people had access to your record — your doctor, his or her nurse and his or her receptionist. Now, you can have thousands of people with access to your records," Mel Holley said Wednesday.
Holley has concluded an investigation into a case last year in which a worker at CancerCare Manitoba, the province's prime centre for cancer treatment, got into the electronic patient files of a neighbour's child who was undergoing treatment. The worker, whom Holley did not identify, did not need to see the child's file for any work-related purpose, but did so because of a personal conflict with the youngster's mother.
"The complainant informed us that after her daughter was diagnosed with cancer in early April 2011, the employee had unsuccessfully tried to obtain information about her daughter from another person known to the complainant and the employee," Holley wrote in his report.
"The complainant suspected that after this attempt to obtain information failed, the employee abused her position at CancerCare and searched CancerCare’s electronic medical records ... for information about her daughter."
CancerCare officials investigated, discovered that the worker had opened the file and ordered the worker not to have any contact with the patient while on the job. But because the worker kept the information to herself, there was no violation of provincial law.
The Personal Healthy Information Act forbids only the disclosure of medical records, not snooping. That should change, Holley said, to ensure that patients do not feel violated.
"You lose that sense of security, you lose that sense of trust and confidence in the facility and the system itself, and I can tell you in this case, the individual was absolutely shaken by it and traumatized."
Holley called on Manitoba to follow the example of provinces such as Alberta, where accessing private health information can bring heavy penalties. In 2007, a medical records clerk involved in a love triangle with a married man was found guilty of snooping on the cancer records of his wife. The clerk was fined $10,000 under Alberta's Health Information Act.
Penalties vary from province to province. In Ottawa in 2010, a diagnostic imaging technologist was found guilty of viewing the health records of her former husband's new wife. The worker was suspended without pay for three days and ordered to undergo counselling and privacy retraining.
Most electronic record-keeping systems maintain a log that shows who went into each file and when. But abuses are usually only discovered after someone complains, Holley said, so hospitals and other facilities should run audits to see whether files are being read by prying eyes.
The Manitoba government said it will act on Holley's report.
"The minister accepts the ombudsman's recommendations and has directed her department to implement those recommendations," read a brief, two-sentence email circulated by Health Minister Theresa Oswald's office.
Note to readers: This is a corrected story. An earlier version said he was the ombudsman.Suggest a correction