Privacy breach at Hay River clinic prompts discovery of 41 'irregularities' with patient files

Another privacy breach has occurred at a territorial health care facility — this time at a medical clinic in Hay River. As a result, the Hay River Health and Social Services Authority is commencing a review of patient files.

In a news release, the authority says an internal audit was conducted after the discovery of "several instances where patient referrals to specialists and other medical services were either delayed or not completed."

In an interview with the CBC, Erin Griffiths, CEO of the authority, said the issue came to light after patients notified the clinic that a referral hadn't been handled properly. 

The authority audited all referrals ordered between Oct. 13 and Oct. 26, 2017 and found 41 "irregularities."

The statement said 18 of those referrals were corrected and there was no impact on the patient. However, 21 patients are being contacted.

"The irregularities found included instances where non-essential patient information was improperly shared with heath care providers," the statement says.

"This improper sharing of information constitutes a privacy breach and proper steps have been taken to notify the patients and the Northwest Territories Privacy Commissioner."

Griffiths said non-essential information would be data that would identify the patient, such as a name, address or phone number.

The review will go back six months, to April, 1, 2017, auditing the last six months of referrals out of the Hay River medical clinic.

Numerous breaches in past

The authority says referral appointments are being rescheduled as soon as possible.

The health authority is bringing in additional staff to help complete the review of the patient files, which it expects will be complete by Dec. 15.

"We would like to apologize to any of our clients who received a delay in service, the Authority has taken appropriate steps to ensure this doesn't happen again," Michael Maher, the authority's public administrator, said in the statement.

N.W.T. providers have a history of privacy breaches. Over the last few years there have been several instances where patients' information has been breached.

In 2016, dozens of patients in Inuvik were notified that their health records had been compromised.

In 2014, a doctor at Yellowknife's Stanton Hospital lost a USB drive containing names, health care numbers and personal medical information for more than 4,000 patients. That same year the N.W.T. Department of Health mailed 195 health care cards to the wrong addresses due to a spreadsheet sorting error.

A few years ago the CBC North newsroom fax machine also received test results, on a number of occasions, containing patients' medical information.

Earlier this month, the territory's privacy commissioner tabled a report saying the N.W.T. is still "far from compliant" with the Health Information Act.

Anyone who has concerns about the breach can contact the health authority at (867) 875-0054.

Were you affected by a privacy breach at an N.W.T. health facility? If so, contact katherine.barton@cbc.ca. 

• Inuvik hospital employees inappropriately accessed patient records, say health officials

• More than 2,000 X-rays, ultrasounds from Stanton Hospital to get 2nd look

• Patient records breached 8 times in last year, confirms N.W.T. health dept.

• Stanton doctor loses USB stick with 4,000 patients' information

• 195 NWT health cards mailed to wrong addresses

• CBC Yellowknife newsroom gets 6th medical fax in 2 years