HO-002

• A patient's personal health information was accessed by a nurse who was not providing care to the patient. The nurse disclosed the patient's personal health information to the patient's estranged husband.
• Section 3 – definition of health information custodian. The hospital was a health information custodian.
• Section 2 – definition of agent. The nurse was an agent of the health information custodian.
• Section 4 – definition of personal health information. The patient’s electronic health record that the nurse accessed was personal health information.
• Section 2 – definition of use. The nurse used the patient’s personal health information.
• Section 37 – permissible use of personal health information. The nurse was not permitted to use the patient’s personal health information and contravened Section 37.
• Section 17 – agents’ collection, use, disclosure and retention of personal health information. The nurse’s use of the personal health information was not in accordance with Section 17.
• Section 2 – definition of disclose. The nurse disclosed the patient’s personal health information.
• Sections 38 through 49 – permitted disclosures of personal health information. The nurse was not permitted to disclose the patient’s personal health information.
• Section 29 – general limitations on the use and disclosure of personal health information. The nurse contravened Section 29.
• Section 12(1) – security of personal health information. The health information custodian breached Section 12(1) in failing to safeguard the patient’s personal health information.
• The health information custodian was ordered to review and revise its practices, procedures and protocols relating to patient health information and privacy, and those relating to human resources, including the implementation of a protocol to ensure that immediate steps are taken upon notification of an actual or potential breach to cease the unauthorized access to, use and disclosure of personal health information.
• The health information custodian was also ordered to ensure that is agents are informed of their duties under PHIPA, pursuant to Section 15(3)(b), and their obligations to comply with the revised information practices of the health information custodian.
• The health information custodian was urged to issue an apology to the patient.

• PHIPA
• Section 2
• 3(1)
• 12(1)
• 4(1)
• 17(1)
• 6(1)
• 15(3)(b)
• Section 29
• 37(1)
• 38(1)
• 49(1)

• A patient's personal health information was accessed by a nurse who was not providing care to the patient. The nurse disclosed the patient's personal health information to the patient's estranged husband.
• Section 3 – definition of health information custodian. The hospital was a health information custodian.
• Section 2 – definition of agent. The nurse was an agent of the health information custodian.
• Section 4 – definition of personal health information. The patient’s electronic health record that the nurse accessed was personal health information.
• Section 2 – definition of use. The nurse used the patient’s personal health information.
• Section 37 – permissible use of personal health information. The nurse was not permitted to use the patient’s personal health information and contravened Section 37.
• Section 17 – agents’ collection, use, disclosure and retention of personal health information. The nurse’s use of the personal health information was not in accordance with Section 17.
• Section 2 – definition of disclose. The nurse disclosed the patient’s personal health information.
• Sections 38 through 49 – permitted disclosures of personal health information. The nurse was not permitted to disclose the patient’s personal health information.
• Section 29 – general limitations on the use and disclosure of personal health information. The nurse contravened Section 29.
• Section 12(1) – security of personal health information. The health information custodian breached Section 12(1) in failing to safeguard the patient’s personal health information.
• The health information custodian was ordered to review and revise its practices, procedures and protocols relating to patient health information and privacy, and those relating to human resources, including the implementation of a protocol to ensure that immediate steps are taken upon notification of an actual or potential breach to cease the unauthorized access to, use and disclosure of personal health information.
• The health information custodian was also ordered to ensure that is agents are informed of their duties under PHIPA, pursuant to Section 15(3)(b), and their obligations to comply with the revised information practices of the health information custodian.
• The health information custodian was urged to issue an apology to the patient.