Privacy training urged for Saskatoon health workers after patient's test results faxed to computer store

Saskatchewan's privacy czar wantsthe Saskatoon Health Region to ensure its employees follow the rules when it comes to faxing personal health information after a patient's test results were sent to a computer store again.

Details of the privacy breach are outlined in an October decision penned by Saskatchewan Information and Privacy Commissioner Ron Kruzeniski.

On Sept. 7, Kruzeniski said someone from Kelly's Computer Works, a store located in North Battleford,contacted his office say that it had received a fax from the non-invasive cardiology unit at St. Paul's Hospital located in the Saskatoon Health Region.

• Watchdog says eHealth breached privacy by sharing personal information with Elections Sask.

The report says the fax was addressed to a doctor and contained results from a patient's exercise tolerance test.

The patient's name, health card number,date of birth and type of medication they were taking wereamong the "highly sensitive" personal health information included in the fax, Kruzeniskifound.

"I find that [health region's] faxing practices do not follow its internal policy and procedure regarding faxing personal health information," he wrote.

Thereport says staff at the computer store deleted the fax and the health region contained the breach, compiledan internal investigation report andnotified the patient about the breach.

• Info breach at Sask. Cancer Agency 'not acceptable:' privacy commissioner

Not the first breach

According to Kruzeniski's report, the health region indicated it was a medical officeassistant whosent the fax. The employee entered the number manually and had one digit wrong.

"This is not the first instance in which the Non-Invasive Cardiology Department at St. Paul's Hospital inadvertently sent a fax to Kelly's Computer Works," intended for a specific doctor, the report reads.

Kelly's Computer Works had previously receiveda misdirected fax from the same department in January 2017.

To prevent future breaches,Kruzeniski recommends the health region follow its existing policies when it comes to sending internal faxes.

The health region says it sends faxes to too many different numbersto program them,and that its fax machine is unable to block outgoing fax numbers like the computer store's.

The report also called for mandatory privacy training for Saskatoon Health Region employees, but the health region said that was a tall order considering the ongoing amalgamation from 12 health regions into one.