Berwick family angry over N.S. privacy breach

A family from Berwick, N.S., is angry at the province's health system for failing to protect private medical records.

On Tuesday, the Nova Scotia Health Authority announced it sent letters to 211 patients whose medical records were snooped on by two employees at two hospitals in Kentville and New Glasgow.

Cameron Shay, 18, received one of those letters and called the Nova Scotia Health Authority Friday morning to learn the details.

"I was like, 'Oh, wow.' My second question was, 'How did she even get in there?'" said Shay, who's been treated in both Kentville and Halifax for a medical condition he prefers to keep private.

"It was pretty devastating to know that she was looking in there. She looked at a lot of stuff," he said.

Family was suspicious

Cameron's father, Allen Shay, said he wondered for years how his son's health details were known to people around Berwick.

He said he discussed Cameron's health with close friends and family, but that was it.

"He had a few MRIs that ... as a family we kept personal. Then we kind of heard on the street about an MRI. And it's like, how did they know he had an MRI?" Allen said.

Cameron also wondered how his neighbours seemed to know so much.

"You just wonder, did that slip out of my mom or dad's mouth? But then I would ask them, and they would say, "No, no!' So then you wonder who it would be?" Cameron said.

Breach affected entire family

The family now believes the mystery has been solved.

In conversations with privacy officials at the health authority, Allen Shay said he was told the name of an employee who looked at his files, as well as those of his wife and son.

It was a name he recognized.

Allen said the employee breached his privacy by checking up on an injury he suffered after taking a puck to his foot while playing hockey.

"She accessed my X-ray and had a look at it I guess," he said. "Actually, she was fairly busy that day. She accessed all our files on the same day," he said. 

Cameron said the employee read through his medical files in detail, accessing approximately 40 pages in all, which included an MRI, a CAT scan, lab report and doctors' notes.

Unclear what disciplinary action was taken

He said he's requested copies of the records the employee looked at so he can be certain what they saw.

Cameron said the privacy official from the health authority told him the employee looked at 86 other patients' records at Valley Regional Hospital in Kentville.

The employee at the Aberdeen Hospital in New Glasgow did not have access to medical files, only the hospital's computer scheduling system.

Health officials wouldn't release any information about the employment status of the two employees involved in the breaches.

Privacy investigation underway

Nova Scotia's Office of the Information and Privacy Commissioner announced Friday it launched an investigation into the breaches.

A spokesperson said complaints from individual patients will be merged with that process, which would normally take six to nine months, but could stretch longer due to COVID-19.

Allen Shay said he's already called the commissioner because he wants to know what policy changes the hospitals will make moving forward.

"My concern is that I want to make sure this isn't happening on a regular basis and, you know, it needs to stop," he said.

Meanwhile, he's wondering what it'll be like running into the employee who snooped on his family's medical files.

"We'll see what kind of day I'm having, I guess... But it's going to be an awkward situation for sure," he said.