Patient records abandoned in Fort Smith Health Centre bathroom
The process by which sensitive health records turned up in a Fort Smith washroom has been scrutinized by the territory’s information and privacy commissioner.
An investigation began after an employee at the Fort Smith Health Centre found a patient’s records on the floor of a staff washroom in November 2019. The commissioner’s report was published earlier this fall.
The unauthorized disclosure of health information included eight pages of the patient’s records, which contained “heart tracings and lab results” ordered by an emergency room doctor.
While the NWT’s health authority initially said it didn’t know how the documents ended up in the bathroom, the privacy commissioner’s office asked if the health authority could audit who had used the bathroom that day.
Because the washroom is just for staff and is accessed using a card lock system, it was possible to pull a list of people who had used the washroom on November 7, the day of the breach.
The health authority looked to see who had used the bathroom immediately before the employee who discovered the records on the floor, but this staff member “claimed to have no recollection of the incident or of managing or handling the records in question” and said they would never bring patient information to the washroom.
There is no indication the health authority interviewed anyone else who used the washroom prior to the papers being found. When the information and privacy commissioner’s office asked to see the list, it was told the authority could not share it “because of how many employees would have been involved in the patient’s care on the date in question.”
Andrew Fox, the NWT’s information and privacy commissioner, criticized this response in his report.
“With respect, more could and should have been done to identify who had been working in the emergency department on the day in question, to identify who had been involved in the patient’s care, and who might have had reason to be handling the patient’s records on that date.”
Because of the workflow in the emergency room, the Fort Smith Health Centre doesn’t track who handles a patient’s records.
“Typically, emergency room encounters still generate paper records and those records flow within the facility for review, signature, coding, scanning and linking, etc,” Fox wrote.
“These activities require record-handling by various staff, including physicians, ward clerks, clinic assistants, medical records staff, and potentially a casual or locum staff member who is assisting with the workload.”
Fox said after the necessary processes were completed, the records should have been physically filed in a patient’s chart. He described alarm that no employees realized the records were missing.
“The questions are obvious and not overwhelming,” he wrote. “Who ordered the tests? Where and how were they delivered? Who received them? What did that person do with them? Where did they go from there and for what reason?
“The custodian should, when necessary, be able to track the progress of any piece of paper it produces from one employee to another during any particular shift.”
Fox said a small health facility should have been able to conduct short interviews with the employees known to be involved with this patient’s records.
“Had the investigation taken place in a timely manner and involved each of the people who may have handled the records, it is far more likely that the investigation would have determined where ‘the train left the tracks,’” Fox said.
The lack of timeliness or thoroughness in the investigation meant the health authority “lost an important opportunity” to learn from the incident, he said.
Fox recommended an employee in each region of the NWT be trained to conduct privacy breach investigations, in addition to his office’s usual recommendations for more employee training and policy review.