Inuvik hospital employees inappropriately accessed patient records, say health officials

Three months after the Beaufort Delta Health Authority alerted the public of a possible information breach, officials confirmed Monday at a press conference that employees "inappropriately" accessed patient health records.

Beaufort Delta Health Authority says several staff members have been disciplined

From left, Stacey Christie, director of Quality Improvement and Health Services; Arlene Jorgensen, CEO of the Beaufort Delta Health Authority; and Nicole Whitcomb, manager of Clinics and Client Records, at a news conference Monday. (CBC)

Three months after the Beaufort Delta Health Authority alerted the public of a possible information breach, officials confirmed Monday at a press conference that employees "inappropriately" accessed patient health records.  

The hospital said it has sent letters to 67 patients informing them their health records had been compromised.

"Through an investigation process we had identified that their information had been inappropriately accessed by staff outside a legitimate scope of duties," said Arlene Jorgensen, CEO of the Inuvik Health Authority.

After a patient complained in October, the hospital discovered a possible information leak

Health authority administrators said Monday that staff were accessing a scheduling system that includes information such as appointment times, check-out dates and the reason patients were at the hospital.

At the press conference, officials assured patients that detailed information, such as diagnoses were not accessed during the breach.

The Beaufort Delta Health Authority confirmed today that there was a breach of patients' health records by employees at the Inuvik Hospital. (CBC)

"It's not a place that we are storing individual in depth information on," said Nicole Whitcomb, the hospital's manager of clinics and client records. "It's merely used as a means for registration and tracking patient visits throughout our organization."

Several staff members who had accessed this information did not need it to do their jobs, according to the health authority. Those employees were disciplined.

The hospital won't say how many employees were involved or whether they're still employed with the hospital. However, officials said the breach was limited to Inuvik's hospital.

"We have no indication that this information was shared outside of the hospital," said Jorgensen.

Health authority officials said they first informed the territory's Department of Health and Social Services and the Northwest Territories Information and Privacy Commissioner about alleged "repeated and inappropriate" access of a patient healthcare records system in December.

Although the authority is still waiting for the results of a final report into the privacy breach, it already has received 46 recommendations from external investigators — many of which call for more staff training — which officials said will be discussed with the territory's health department.