The Thunder Bay Regional Health Sciences Centre president and CEO is apologizing for a breach of personal health information.
Five-hundred patient records have been affected by a TBRHSC physician sharing their password and username with another physician who does not have privileges at the hospital, said Andrée Robichaud.
“This resulted in a breach when this individual remotely accessed our electronic diagnostic imaging system without Thunder Bay Regional Health Sciences Centre’s knowledge or authorization,” said Robichaud, noting that physician accessed diagnostic imaging exams that included patients’ names, dates of birth, sex and the report describing the interpretation of the image.
“I offer my sincere apology to each and every one of (the patients),” she said Monday morning.
Doctors are allowed to share personal health information for the purpose of providing health care, but they have to follow provincial policies and standards.
The Office of the Information and Privacy Commissioner of Ontario has been notified and is investigating and letters have been sent to each patient impacted.
The breach extends from July 2012 to April 2013 and was discovered in early April, said Robichaud.
“There were multiple gymnastics to do from an IT perspective to be able to come up with the list and determine to what extent and when it began,” she said.
“We welcome the opportunity to meet with any patients or family members who would wish to discuss this incident,” said hospital chief of staff Gordon Porter.
Porter said information sharing between doctors is not uncommon, but it is done under the guidance of regulations imposed through the privacy act through the College of Physicians and Surgeons as well as the bylaws of the hospital.
He added the other doctor in question has never been affiliated with the TBRHSC.
“The information was shared with an uncredentialed physician at the time of the breach,” he said. “They have never had privileges at the hospital.”
Porter said he wasn’t free to say whether anyone has lost their job, but the process that governs the credentialed physician has been followed internally through a medical advisory committee.
“That process has ensured this wouldn’t happen again,” he said.
Other hospitals or health facilities in the region are also affected. Robichaud said there are records impacted from outside of Thunder Bay.
“However, each institution is the health information custodian for the health information so I cannot speak on behalf of the other hospitals,” she said.
