Ontario privacy watchdog fines Windsor pediatrician and clinic for misuse of patient data

The Office of the Information and Privacy Commissioner (IPC) of Ontario has fined a Windsor, Ont. pediatrician, Dr. Omar Afandi, and a pediatric clinic, WE Kidz Pediatrics, for accessing personal health information from the shared Oracle Health EHR used by Windsor Regional Hospital, the Chatham-Kent Hospital Alliance (CKHA) and Erie Shores Healthcare for the purpose of financial benefit.Between April 20 and May 7, 2024, Dr. Afandi used search features with the EHR to collect newborn and contact information to offer circumcision services through WE Kidz Pediatrics, a private clinic which he partially owned. Dr. Afandi conducted these searches 146 times and was potentially able to access and view the personal health information of up to 831 patients.Dr. Afandi reported that he contacted 17 parents of male infants by text message and acknowledged contacting others by phone from the WE Kidz clinic. According to the IPC decision, he reported being “aware of one patient from CKHA who booked a circumcision appointment with him due to his phone solicitation.” Financial compensation for the procedure was $350, including a $35 overhead fee for the clinic.Read: Doctors up in arms over lab report fatigueThe IPC assessed an administrative monetary penalty of $5,000 against Dr. Afandi and a $7,500 penalty against WE Kidz, the first administrative monetary penalties issued by a privacy commissioner in Canada, according to the IPC. Dr. Afandi no longer holds privileges at Windsor Regional.In his defence, Dr. Afandi claimed he was unaware that his practice of accessing patients’ personal health information for the purpose of soliciting them for circumcision services was contrary to his privacy and confidentiality obligations under PHIPA, that he immediately ceased this practice when he was confronted by Windsor Regional’s chief of staff and that he was “genuinely remorseful.” Dr. Afandi also told the IPC that his access to the EHR “did not involve opening the charts” and was “limited to viewing basic demographic information about eligible patients” and collecting their phone numbers.The unauthorized use of personal health information was reported by two parents, including one mother who “had delivered a baby at the CKHA the day before and, while still an inpatient at CKHA, received a call from WE Kidz asking if she would be interested in having her newborn circumcised.”The IPC found that Windsor Regional had “reasonable measures in place to protect PHI (personal health information) in its custody,” but “appeared to have some difficulty in providing detailed evidence of its compliance with its information practices.” The decision included several recommendations for improving its documentation.“In contract, with respect to WE Kidz, I find that, at the time of the breach, it sorely lacked any of the essential elements of a data privacy and security governance program,” concluded IPC commissioner Patricia Kosseim. “In fact, upon opening its doors for business, the evidence demonstrates that it had no privacy management program at all” and was therefore in breach of its obligations under PHIPA.“This case should serve as a cautionary tale for any start-up in Ontario’s health sector that decides to put the cart before the horse, and begin operating without the necessary privacy policies, procedures and practices in place,” she warned.The IPC can levy administrative monetary penalties of up to $50,000 against an individual and up to $500,000 against an organization following the adoption of a new regulation effective January 1, 2024.The monetary penalty levied against Dr. Afandi took into consideration the potential economic benefit to him if the two patients had not complained and his access to PHI had continued, while the penalty levied against WE Kidz was justified “to encourage WE Kidz and other start-ups in the health sector to respect and comply with their basic obligations as custodians under PHIPA and ensure that these foundational protections are in place prior to commencing their operations.”“The harm to patients outside Dr. Afandi’s circle of care is not to be underestimated,” stated the decision. “These patients had just given birth and could have been in a vulnerable emotional state. Being disturbed by someone out of the blue who would have contacted them by phone to offer circumcision services at a private clinic could have left many of them highly perturbed, questioning how such a physician, unrelated to their care, got access to their phone number and other PHI in the first place.”The IPC decision can be accessed here.

Ontario privacy watchdog fines Windsor pediatrician and clinic for misuse of patient data

Register for free access or login.

Related Topics

Business Topic