CALGARY (CP) — Alberta's information and privacy commissioner says 49 health workers unlawfully viewed and used information about a Calgary patient and her daughter in 2015.
The investigation started after the Alberta Health Services privacy office was notified of a breach of information by the emergency department manager at South Health Campus.
The patient's file had been flagged as confidential when she was admitted to the hospital.
An internal audit identified 160 employees gained access to information on the patient and her daughter, and that 49 times it was done outside the role of providing a health service.
The 49 included managers, nurses and non-nursing or clerical staff.
The privacy commissioner's office also found Alberta Health Services did not take reasonable steps to put technical and physical safeguards in place to protect the information.
``Despite having reasonable administrative and technical safeguards in place, the ... investigation also found that AHS did not take reasonable steps to implement technical safeguards, noting that many of the 49 employees reportedly left their smart cards in the electronic medical system for their entire shift,'' the report said.
``Smart cards are a way to uniquely identify system users, and the practice of leaving cards in the system defeats the protection this technology offers....''
AHS said it had to reduce or rescind discipline of the 49 because management did not enforce the policies.
``The employees themselves believed their accesses were appropriate within a team-based approach to providing health care, and they were following established practices known and supported by management.''
The privacy commissioner's office made six recommendations to AHS and says many were addressed during the investigation.