Sask. privacy commissioner chides two doctors after medical records found ‘blowing around the alley’ behind clinic

Saskatchewan’s information and privacy commissioner has found that two doctors failed to take adequate steps to contain a privacy breach after paper medical records were found loosely blowing in the wind behind a medical clinic.In late October 2024, Commissioner Ron Kruzeniski received separate reports from two individuals who had recovered several loose medical records in an alleyway behind the Elphinstone Medical Clinic in Regina. The two individuals had seen posts on a local Facebook group about these records strewn in an alley outside the clinic and retrieved some of the records. One of the individuals said they had collected “about 100 pages” of records and dropped them off at the commissioner’s office, Kruzeniski wrote in his March 26 report.The College of Physicians and Surgeons of Saskatchewan also contacted the commissioner’s office after receiving a report of records “blowing around the alley.” Kruzeniski’s staff also visited the area and retrieved one additional record.A total of 88 individuals were affected by the breach and nearly all were patients of Dr. Nebeolisa Ezeasor, a psychiatrist working at the clinic. Two of the individuals were patients of psychiatrist Dr. Chukwuemeka Odenigbo, who owns the clinic.Most of the records were psychiatric intake forms. They contain information such as name, date of birth, names of primary care physicians and counselors or therapists, and information pertaining to the psychiatric issues they may be facing.Some of the other records included self-assessments that included more details on symptoms, history of illness, medications prescribed, summary of psychiatric concerns and other medical history. These records also contain names of patients, addresses, dates of birth and Saskatchewan Health Numbers.Dr. Odenigbo and Dr. Ezeasor had told the commissioner the breach was caused by a cleaning contractor. The contractor’s employee, who has since been terminated, had mistakenly placed the records, which were intended to be shredded, into an open recycling bin in the alley behind the clinic.The doctors said they believed these records were safe, given that they were placed in recycling bins under the desks inside their offices, in an area where patients cannot enter without being escorted. However, Kruzeniski took issue with the fact that the in-office recycling bins did not have locks.“Even if they were unaware that these records should not be touched, it appears that the contractor would have still had regular access. If the clinic had locked bins as a form of physical safeguard from the start, it is likely that the privacy breach would have never occurred,” he wrote.Kruzeniski also said Dr. Odenigbo and Dr. Ezeasor did not take adequate steps to contain the breach. The two doctors said they “reviewed and catalogued” the records and ensured the “matter was immediately raised with the contractor,” but Kruzeniski noted they “did not provide much else beyond this to address containment efforts.”While there were two individuals who reported the incident to the commissioner’s office, Kruzeniski noted it’s unknown whether anyone else may have also retrieved any of the medical records after seeing the Facebook post. Kruzeniski also said it’s possible that some records may have been blown into the yards of the nearby homes or picked up by attendees of a nearby football game that was happening that weekend. “Dr. Odenigbo and Dr. Ezeasor could have taken some steps towards containment by, for example, following up with individuals on the Facebook group who may have indicated they found or saw records, or by asking residents who share the alleyway if they had found or seen records,” the commissioner wrote.The two doctors also sent letters to the affected patients, but Kruzeniski noted in his report that the letters only told patients that “a privacy breach . . . recently took place involving your personal health information” without explaining what data elements were involved for each individual. In addition, Kruzeniski said the doctors should have offered the patients a year of free credit monitoring.“While the doctors’ notice does include risk of identity theft based on name and birth date, the notices should have also included what specific data elements were involved for each patient so that the doctors, and affected individuals, could have gauged personal risk accordingly. The letters should have also included ways that affected individuals could mitigate risks such as risk to reputation,” he wrote.As part of his recommendations, Kruzeniski said the doctors should sign confidentiality agreements with contractors and employees of contractors going forward and use recycling bins with lockable covers or keep paper records awaiting destruction in a locked drawer or cabinet. Kruzeniski also recommended that the clinic use verification documents when uploading patient records into their EMR. The verification document should include a description of the record, the name of the individual reviewing the record, the individual’s authorization for the destruction of the paper source of the record and an explanation on how and when the paper record was destroyed.

Sask. privacy commissioner chides two doctors after medical records found ‘blowing around the alley’ behind clinic

Register for free access or login.

Related Topics

Business Topic