Nurse suspended after snooping on patients ‘Crisis situation’: repeat offender latest in string of health-care privacy breaches By: Tyler Searle Posted: 6:46 PM CDT Monday, Apr. 29, 2024

A Manitoba nurse has been suspended and fined after admitting to snooping through the personal health information of patients — the latest in a series of privacy breaches affecting thousands in recent years.

A review of discipline reports released by the College of Registered Nurses of Manitoba revealed at least four other nurses have been punished for improperly accessing health information since 2018.

Collectively, the privacy violations have impacted as many as 2,140 patients.

“If I were part of the leadership of the (college), I would be alarmed,” said Arthur Schafer, former director of the Centre for Professional and Applied Ethics at the University of Manitoba. “This is a crisis situation where one of the most fundamental principles of nursing ethics is being violated frequently, endangering patient privacy and endangering the basic values of health-care ethics.”

The college released details of the most recent offence in a partially redacted decision on April 15. The documents show the nurse admitted to accessing the electronic personal health records of 57 patients between Sept. 18 and Oct. 8 of 2021.

A college inquiry panel, tasked with reviewing the incident during a hearing on Feb. 14, noted the nurse had previously been caught by her employer and suspended for five days for a privacy breach.

She was later ordered to complete additional education training on the Personal Health Information Act, the report says.

“Accessing personal health information is an extremely serious breach of trust and breach of integrity; and this was the second episode of improper access to personal health information,” it says. “Any improper access of patient records is unacceptable, regardless of the motivation, and such access constitutes professional misconduct.”

The name of the health-care facility where the offences occurred is redacted.

Martin Lussier, the college’s communications manager, said employer information is withheld from public reports for privacy reasons.

He could not confirm whether the patients affected by the breach were contacted by the hospital, saying the college does “not have any oversight into how employers may deal with privacy breaches.”

“If I were part of the leadership of the (college), I would be alarmed.”–Arthur Schafer

He pointed to the health information act, which says patients who have their privacy breached must be notified “if, after considering the relevant factors prescribed in the regulations, the breach could reasonably be expected to create a real risk of significant harm to the individual.”

The legislation guidelines define significant harm as any information that may cause bodily harm, humiliation, damage to relationships or reputation, loss of employment or identity theft.

The ruling does not reveal what motive, if any, the nurse had for accessing the information. It says she did not disclose the information to anybody else.

Lussier said the “reasons and patterns of behaviour” for the offences were taken into consideration by the college’s inquiry panel, but the information cannot be shared publicly.

Schafer scoffed at the justification, saying: “people are entitled to know.”

“Do we know on whom she snooped and why? We don’t. Is it prominent people? Is it her former sexual partners or family members, or is it her neighbours?” he said.

“If we don’t know where she works, the public or journalists can’t pose the question to the hospital about (whether they have notified the affected patients).”

“Do we know on whom she snooped and why? We don’t. Is it prominent people? Is it her former sexual partners or family members, or is it her neighbours?”–Arthur Schafer

The report says the college considered several mitigating factors in determining how to discipline the nurse, including her admission of guilt and the fact she is “genuinely remorseful.”

Lussier stressed the college considers inappropriate or unauthorized access to personal health information to be a serious matter and a review by the inquiry panel is considered among the most significant penalties a registered nurse can face.

In this case, the nurse was suspended for two weeks effective March 11 and ordered to pay $4,000 in costs. The decision was reached through a joint agreement between the inquiry panel and the nurse’s legal counsel.

Her punishment was consistent with others handed down by the regulatory body for privacy violations.

Last year, a nurse was suspended for three weeks and ordered to pay $4,000 after accessing the health files of 37 patients, most of whom were not under his care.

The year prior, two nurses were disciplined with the same fines and suspensions after breaching the privacy of as many as 296 patients, collectively.

In one of the related decisions, the inquiry panel noted nurses “will see a number of (computer) ‘popups’ to reinforce the importance of maintaining privacy” when they attempt to access health information.

In a case from 2018, a nurse found guilty of professional misconduct received a two-week suspension and was ordered to pay costs of $3,500 to the college for breaching the privacy of 1,750 patients. She had previously received an interim suspension of nearly four months in connection to the breaches.

The woman told the panel she was using the emergency department information system at the facility where she worked to assist colleagues and “obtain information for her own educational purposes,” the related discipline report says.

The college found her explanation unacceptable.

“The member knew her conduct was wrong. In addition to her (Personal Health Information Act) training, the member was warned by a manager on March 19, 2018, that she could get into trouble if she continued to access (personal health information). She failed to heed this warning,” the report says.

Schafer said the number of violations indicate some nurses either believe it is acceptable to access private information unnecessarily or do not fear the disciplinary consequences.

“One of the purposes of disciplinary action is to punish people who violate basic rules… but a more important objective is to deter others, which means you need significant punishments for significant offences.”–Arthur Schafer

The ethicist called the punishments “outrageously inappropriate,” saying they signal to other health-care professionals and patients that breaching privacy is a minor offence.

“What is wrong with the ethics education that our nurses are receiving that so many of them believe this is OK, and why has the college continued to offer comparatively trivial disciplinary punishments?” Schafer said.

“One of the purposes of disciplinary action is to punish people who violate basic rules… but a more important objective is to deter others, which means you need significant punishments for significant offences.”

Lussier said it is fair to ask whether temporary suspensions are an effective deterrence for nurses.

“This is a good question, and one that we continue to monitor based on the nature and types of complaints that we receive, whether there are specific trends, and how best to address and/or mitigate related risk factors.”

The Manitoba Nurses Union declined to comment.

The Free Press was unable to reach the nurse named in the April decision report. The lawyer who represented her did not respond to requests for comment.

tyler.searle@freepress.mb.ca