Too many staff at the Vancouver Coastal Health Authority had too much access to personal patient information, according to B.C.'s privacy commissioner. (CBC)

British Columbia's largest health authority is being criticized for the second time in a month over the way it has handled computerized patient health records.

Privacy Commissioner Paul Fraser said Friday that privacy was the missing ingredient when the Vancouver Coastal Health Authority set up a database containing personal health information that was accessible by about 4,000 users.

Personal health data was routinely being shared with other public bodies and non-profit agencies without legal authority, Fraser said.

'Health authorities must learn from the mistakes identified in this investigation.' —Privacy Commissioner Paul Fraser

Fraser's report corroborates the findings of B.C.'s auditor general, who said in February that thousands of staff at the health authority had access to personal data they neither had the need nor the right to see.

The database is known by its acronym PARIS for Primary Access Regional Information System. It contains information about patients' finances, social insurance numbers, diagnoses, care and doctors' and counsellors' notes.

The health authority simply didn't consider privacy concerns when it launched the data-sharing system, Fraser said.

Practices changed

It's a practice that should cease, and in large part it already has, he said.

"What has happened is for the most part, those violations have been cured. I think what has essentially changed in bottom-line terms is that there was a realization too many users had too much access to too much information."

The B.C. Information and Privacy Association said the potential for violations was shocking and feared that similar conditions could exist in the filing systems of other B.C. health authorities.

"There is no real sense that there is any appreciation that this information belongs to individuals, to citizens of B.C., to patients," said the association's policy director, Vincent Gogolek.

"It's ours to dispose of — not for government or health authorities to distribute as they see fit for whatever purpose."

PARIS is one of eight databases in B.C. that contain patient information.

"Health authorities must learn from the mistakes identified in this investigation by ensuring that privacy is not added on at the end, but baked into the entire functional design," Fraser said.

With files from The Canadian Press