Providing Healthcare in a Public Health Emergency Part 4: Avoiding Missteps and Professional Consequences in a Privacy Breach

Part 4: Privacy Breaches

Welcome to part four of our ongoing blog series exploring how health care providers (HCPs) can avoid missteps and professional or legal consequences in the face of shifting professional responsibilities and challenging work environments caused by the COVID-19 pandemic. In this installment, we will discuss the potential consequences of a privacy breach during a public health emergency.

Privacy Breach

As was discussed in part three of this series, protecting patient privacy is a core professional responsibility for HCPs as well as a legal requirement under the Personal Health Information and Protection Act, 2004 (PHIPA). Maintaining the required safeguards for personal health information (PHI) during COVID-19 may be challenging in light of changes to work processes, such as working from home or providing remote services, as well as shortages of staff or a high-pressure environment, which may lead HCPs to make mistakes or take shortcuts. It is also possible that staff will be motivated to “snoop” to find out information regarding an individual’s infection status.

Whatever the reason, once a privacy breach occurs, management of the breach can take valuable time and resources away from the provision of care. It is important that health care facilities have privacy policies, including a privacy breach management protocol to both prevent privacy breaches, and manage them appropriately if they do occur. A privacy breach, if publicized, may also lead to diminished trust in a given HCP, facility or profession, a complaint and investigation by the Ontario Information and Privacy Commissioner (IPC) or an HCP’s regulatory college, and may even result in legal liability under one of the common-law privacy torts.

The Ontario Privacy Commissioner is currently looking into a privacy breach involving the personal health information of residents of the Orchard Villa long-term care home. The breach is reportedly the result of a staff member taking photographs of resident records contrary to the Personal Health Information Protection Act, 2004. The alleged breach was publicized after MPP Merrilee Fullerton tweeted about the breach on May 9, 2020. Dr. Fullerton took care to state that Orchard Villa had already informed the IPC and other authorities.

This alleged breach could not come at a worse time for Orchard Villa, as this same long-term care home is one of several similar facilities in Ontario coping with a deadly a COVID-19 outbreak. At the time of writing, at least 69 residents of the facility have died and several staff have been contracted the disease (for up to date information regarding COVID-19 infection rates and deaths in Ontario, please visit the province’s official website). The family of a deceased resident of Orchard Villa has filed a lawsuit alleging that the facility has been negligent and has failed to protect its residents from COVID-19. Although it is not clear yet whether the alleged privacy breach was related to COVID-19 in some way, it means potentially greater legal liability for the already beleaguered Orchard Villa and is yet another blow to the public’s confidence in the home, and indeed in Ontario’s long-term care sector.

Consequences for the staff member who caused the alleged breach could range from being disciplined or fired by Orchard Villa, to an investigation by their regulatory college if they are a regulated health professional, and may even form the basis for legal action under the common-law privacy torts.

This is one example of how acts of professional misconduct may arise in the context of a public health emergency, and why, now more than ever, HCPs should ensure that they are up-to-date and familiar with professional standards. This includes public health directives, emergency orders, and other policies that affect how HCPs deliver health services during the current public health emergency.

If you or your organization have questions regarding how to implement public health directives and other COVID-19 related policy changes, please contact us.

Additional resources for HCPs:

• Ministry of Health and Long-Term Care “COVID-19: Guidance for the Health Sector”

• College of Physicians and Surgeons “Covid-19: Information for Physicians”

• College of Nurses of Ontario “Covid-19: Information for nurses”

• Ontario College of Pharmacists “Novel Coronavirus (COVID-19) for Pharmacy Professionals”