Regina clinic failed to notify patients of privacy breach, says commissioner

Article content continued

The investigation also found that the clinic did not notify the patients who were named in the notes stored on the dictaphone. According to the investigation, the clinic “did not want patients to fear that all their medical information had been compromised as it was only the diagnosis of that day that was recorded.”

The clinic said it also did not notify patients because only their names were mentioned in the notes. Kruzeniski did not agree with the clinic’s reasoning for not notifying patients.

“A patient’s name is enough to identify an individual. This puts all the affected individuals at risk of being identified by whoever finds the dictaphone,” wrote Kruzeniski.

After receiving a draft of the Kruzeniski’s report, the clinic agreed to notify its patients.

The commissioner’s office also asked the clinic for a document establishing trusteeship and responsibility for patient records at the clinic. Despite requesting the document multiple times, the commissioner’s office never received it, or copies of the clinic’s privacy policies. The clinic only said it had a clean desk policy.

The report concluded that the clinic did not appear to have the proper administrative safeguards in place.

While asking for the documentation, Kruzeniski wrote his office was only told that Adams was not working during the COVID-19 pandemic.

Kruzeniski recommended that Adams, along with the clinics two other partners, Dr. Mark Cameron and Dr. Ashis Paul, develop comprehensive written privacy policies and procedures. The clinic has said it will follow his recommendation, according to Kruzeniski’s report.