She only learned her privacy had been breached by filing an access to information request

A woman in Nova Scotia says people should not assume their health records are safe from snooping, something she discovered for herself only after filing an access to information request.

Patricia Celan said she decided last June to file a request to determine whether anyone had accessed her records after seeing news reports about privacy breaches in the health-care system.

The result showed that a fellow Dalhousie University medical school resident had inappropriately accessed Celan's records multiple times in March of 2023. She had not been previously notified of the privacy breach.

"I was shocked to see that and shocked also that nobody had brought it to my attention, that I had found out by filing a request for logs myself," Celan said in a recent interview.

Concern about a lack of action

When she took her findings to Nova Scotia's health authority, Celan said officials confirmed the breach and that there was no reason for the person in question to have looked at her records.

But Celan said she was also told there was little that could be done because by that point the resident who had snooped in her records had completed his training and was working as a doctor in another province.

She said officials at Dalhousie told her something similar.

"For this to not be proactively caught, for me to have to find it on my own and for there to be no consequences for somebody who has breached my privacy while he was in training to be a doctor — it tells me that this isn't really a priority for them," said Celan.

"And that is concerning because doing something like this is a reflection of someone's ethical values and now that person is practising as an independent physician and facing no consequences for this."

Celan said she's also filed a complaint with the College of Physicians and Surgeons of Nova Scotia.

Dalhousie, health authority respond

No one from Dalhousie University's medical school or Nova Scotia Health would do an interview for this story.

In a statement, Dalhousie spokesperson Jason Bremner said the faculty of medicine expects students, residents, faculty, administration and staff "to display professionalism, individually and collectively," in all their interactions.

"All reported breaches of professionalism by Dalhousie learners are taken very seriously and addressed by the Office of Professional Affairs and applicable policies. Unacceptable behaviour is subject to a number of actions based on those policies."

Bremner said the school ensures that the health authority provides learners with an orientation that includes an overview of various policies, but he referred questions about privacy breaches of medical records to Nova Scotia Health.

A health authority spokesperson said in a statement that officials take their commitment to maintaining privacy seriously, and that it's important that everyone using the health-care system be able to trust that their records are protected.

Previous experiences

"Nova Scotia Health has privacy policies and processes in place, conducts routine audits and provides training on confidentiality and privacy for employees, physicians (including medical residents), learners, volunteers, and all others acting as agents on behalf of Nova Scotia Health," said Brendan Elliott.

"They are also required to sign a confidentiality pledge as part of a commitment to protect privacy."

Elliott said when the health authority becomes aware of a suspected privacy breach, the matter is investigated and "appropriate action is taken" when a breach is confirmed.

Celan said this was not the first time her privacy was breached. She said while training at Dalhousie, she was made aware of several instances when emails containing sensitive information about her were mistakenly forwarded by senior school staff, including a former program director and postgraduate dean.

In each case, she said, she was told it was an accident.

"But when things like that happen repeatedly in various forms, it tells me that my right to privacy means very little in this system."

David Fraser, a Halifax-based lawyer at McInnes Cooper who specializes in privacy law, said Celan's thought to request information about her own records was prudent and one that all members of the public should consider.

Fraser said people who could be particularly vulnerable to snooping are those with past or present friends or family members who might have access to records. He said snooping cases are common and it's often because of a personal connection.

He said issues with snooping are not unique to Nova Scotia Health or even the health-care system in general. There are automated systems that help detect snooping and they can be good, but Fraser said they cannot catch everything.

The best way to mitigate risk within a system is through rigorous audits, reviews and ensuring staff know there will be no tolerance for breaking the rules, said Fraser. Even then, however, he said no system is 100 per cent foolproof.

"It can be reduced significantly, I think, with training and with strong discipline, but I don't think you're ever going to get it down to zero."