Hospital clerk's snooping could cost Nova Scotia taxpayers $1M

The actions of ahospital employee who went snooping around hundreds of patient records for more than a year could cost Nova Scotia taxpayers $1 million in a proposed settlement.

Court documents filed as part of a class action lawsuitidentify the employee at the centre of the privacy breach asCheryl Decker, an admissions clerk at Roseway Hospital in Shelburne.

• 707 patient records breached atRosewayHospital

The privacy breach came to light in April 2012 when another employee caught Decker looking up patient records on a work computer and reported it to management.

Privacy violated

An audit was subsequently carried out and 707 patients within the district health authority receiveda letter in the mail advising them their personal health information had been inappropriately viewed. Decker was authorized to look at only 12 of those patient files.

Willa Magee, 70, is one of two patientsfronting thelawsuit against theSouth West District Health Authority, oneof ninedistrict health authorities that have sincemerged to form the Nova Scotia Health Authority.

Magee said she feels her privacy was violatedafter her hospital records were spied on five times over a year.

"It was kind of invasive having someone look at your records even if there wasn't anything particularly interesting in your records," said the Shelburne woman.

"Like having a robber come into your house and go through your most private things."

'That is when I kind of got ticked off'

She followed up with the hospital's privacy officer and was told an employee had been fired. A printout about the breaches that was sent to Mageeoffered little explanation.

Magee said the privacy officer showedalack of concernregardingemployee agreements to protect patient confidentiality and that's what drove her to call a lawyer.

"[The officer]basically said, 'Yes, but you can't expect everybody to comply.' So that is when I kind of got ticked off," said Magee.

"It didn't seem like it was terribly important to them."

$1K in damages to each patient

The proposed $1-million settlement is due to be heard June 22 in Nova Scotia Supreme Court in Halifax. If approved, class members would receive $1,000 each, with the balance covering legal costs and payment to the law firm.

Ray Wagner, a partner in the Halifax law firm that's behind the lawsuit, said hebelieves it's the first class action lawsuit in Canada to deal with the breach of medical records.

Not only did the snooping go on for well over a year, Wagner said the impact is magnified because many of the 707affected patients live in Shelburne, which has apopulation of 1,400.

Wagner said it's unknown why the clerk was looking at the informationand whether she shared or used the information.

The settlement addresses an area of negligence that's emerged in the age of electronic information storage, he said.

'We regret this happened and apologize'

In a statement, the Nova Scotia Health Authority saidit's pleased to be close to reaching a conclusion to this incident.

"It is essential that patients are able to trust that their personal health information is protected. We regret this happened and apologize to those who were impacted," read the statement.

Martina Munden, general counsel for the health authority,was unable to comment on the specifics of the Roseway Hospital breach. However, shesaid consolidation of the health authorities has led to streamlined processes in the protection of privacy. She cited monthly auditing that acts as a deterrent, employeeeducation and training, and followup which can include employee discipline.

But sheacknowledged that an employee's pledge to protect information "may not work in every case."

Wagner said the breach has forced the hospital to toss out its old auditing system.A new system that tracks people who access information in that hospital has been introduced.

He's nowpursuing a claim against the former Capital District Health Authority involving about 120 patients.

Not about the money

For Magee, joining the lawsuit was never about seeking monetary damages. Her goal was to compel the hospital to improve its safeguarding of patient records.

She still has questions about why the clerk, whomshe doesn't know, was so curious about the medical information of so many people.

"You wonder whether she had time to do her work looking at the files of all those people," she said with a laugh.