Inuvik hospital employees inappropriately accessed patient records, say health officials

Three months after the Beaufort Delta Health Authority alerted the public ofa possible information breach, officials confirmed Monday at a press conferencethat employees "inappropriately" accessed patient health records.

The hospital said it has sent letters to 67 patients informingthem their health records had been compromised.

"Through an investigation process we had identified that their information had been inappropriately accessed by staff outside a legitimate scope of duties," said Arlene Jorgensen, CEO of theInuvikHealth Authority.

• Inuvik hospital confirms potential data breach by employees

After a patient complained in October, the hospital discovered a possible information leak.

Health authority administrators said Monday that staff wereaccessing a scheduling system that includes information such as appointment times, check-out dates and the reason patients were at the hospital.

At the press conference, officials assuredpatients that detailed information, such as diagnoseswerenot accessed during the breach.

"It's not a place that we are storing individual in depth information on," said Nicole Whitcomb, the hospital's manager of clinics and client records. "It's merely used as a means for registration and tracking patient visits throughout our organization."

Several staff members who had accessed this information did not need it to do their jobs, according to the health authority. Those employees were disciplined.

The hospital won't say how many employees were involved or whether they're still employed with the hospital.However, officialssaidthe breach was limited toInuvik's hospital.

"We have no indication that this information was shared outside of the hospital," said Jorgensen.

Health authority officialssaid theyfirst informed the territory's Department of Health and Social Services and the Northwest Territories Information and Privacy Commissioner aboutalleged "repeated and inappropriate" access of a patient healthcare records system in December.

Although the authority is still waiting for the results of a final report into the privacy breach, it already has received 46 recommendations from external investigators many of whichcall for more staff training which officials said will be discussed with the territory's health department.