Sorry, wrong number? How three doctors, one surname and multiple fax machines added up to privacy leaks for 109 patients

What’s in a name? Maybe big trouble if you’re a doctor with a fax machine and a surname that’s shared by other physicians.That’s what three Saskatchewan doctors learned recently, after 85 faxes and one letter that were sent to one of them were discovered to have been intended for two other physicians with the same last name—a mistake that inadvertently leaked the confidential health information of 109 patients.Dr. Darcy Marciniuk, a respirologist in Saskatoon, was the recipient of the misdirected correspondence, which included echocardiography reports, cardiology reports, hospital discharge records, lung function reports, ophthalmology reports, pathology reports, lab results, medical imaging results, patient care notes, referral letters and consultation notes, according to a CTV News article.But these documents weren’t for him. Instead most were supposed to go to Dr. Jeffrey Marciniuk—also a Saskatoon respirologist—while one fax was addressed to Dr. Tanya Marciniuk, a pediatrician who practises in the same city.The misdirected documents—which in some cases contained a patient’s name, health card number, address, phone number, gender and birth date—were sent by various parties that included clinics and large organizations such as the Saskatchewan Health Authority (SHA) and Saskatchewan Cancer Agency, the report says. Read: New year, new penalties: Why a privacy breach could now cost you as much as $200KDr. Darcy Marciniuk said he redirected the faxes and mail as soon as he discovered the error and notified the senders about their mistake. He also contacted the provincial health authority but did not get a response.The province’s information and privacy commissioner, which launched 14 separate investigations into the incidents, placed much of the blame on fax machines but also cited human error as a contributing factor.“The majority of the misdirected faxes involved the use of digital fax machines with built in directories or address books for physicians, pharmacies and others,” the commissioner wrote in his investigation report on the Marciniuk cases. “In some cases, misdirection arose when an individual received unclear direction as to the recipient from a physician. In other cases, the wrong or incomplete name was provided by the patient to the health care provider or registration staff. In some cases, the sender chose the wrong recipient from the directory. In other cases, Dr. (Jeffrey Marciniuk’s) name did not appear in the directory. In all cases, human error contributed in some way to the breaches.”Noting that fax machines were also in use in three previous privacy breaches, the commissioner recommended a move away from traditional fax machines towards electronic information management systems.“However, the use of these systems does not eliminate the risk of error by the user,” wrote the commissioner. “To address this risk, clear policies and procedures setting out rules and defining roles, and repeated privacy training and privacy awareness raising activities are essential safeguards. Comprehensive and mandatory annual privacy training is essential to reinforce defined processes and procedures, and the development and maintenance of a culture of privacy.”Read: Just the fax, ma’am

Sorry, wrong number? How three doctors, one surname and multiple fax machines added up to privacy leaks for 109 patients

Register for free access or login.

Related Topics