Investigations revealed a nurse in Thessalon First Nation accessed the personal health information of 34 patients receiving care through Indigenous health-care provider
The province’s privacy commissioner has determined an Indigenous health-care provider failed to protect personal information when a nurse accessed and shared patient records in Thessalon First Nation.
An investigation was launched after Maamwesying North Shore Community Health Services reported a privacy breach to the Information and Privacy Commissioner of Ontario in February 2024.
The IPC learned a community health nurse viewed the electronic charts of 34 patients — without authorization — over the course of a three-month period beginning in October 2023.
The patient records contained various types of personal health information, including:
Name, address, phone number, and email address
Health card number
Date of birth
Next visit date
Family history
Medical conditions
Immunization record
Referral forms
Encounter notes
Progress notes
Diagnostic imaging requests
Lab requisitions
Smoking status
All 34 patients did not receive health care from the nurse and were considered “outside her circle of care,” IPC investigator Francisco Woo said in the decision.
Further investigation by Maamwesying revealed that the personal health information of seven patients was disclosed during a December 2023 meeting — involving the nurse, a council member, an assistant to the chief and an employee of the First Nation.
The meeting was held at a conference room in the Thessalon First Nation band office after a laptop containing medical records was removed from the community’s health centre.
Both the nurse and the late Thessalon First Nation Chief Joe Wabigwan denied the incident took place.
The organization subsequently terminated the nurse’s access to all electronic medical records and “relieved her of her duties” after becoming aware of the breach.
It was first discovered in January 2024 after Maamwesying began receiving lockbox requests from “a large number of the community’s patients seeking to restrict chart access by a registered nurse.”
While IPC found that Maamwesying lacked “reasonable measures” to protect personal health information from unauthorized use and disclosure, it was satisfied overall with the steps taken by the health-care provider in order to contain the breach.
As previously reported by SooToday, Maamwesying pulled all of its workers and resources out of Thessalon First Nation in April 2024 in response to the breach.
Since then, the organization has introduced a new internal policy on privacy and security training and new guidelines on access to electronic medical records.
It also implemented a privacy warning flag in its electronic medical records system where users must now agree to a pop-up confidentiality acknowledgement, as well as a new documentation standard requiring users to record their reasons for accessing patient charts.
Maamwesying is now conducting both scheduled and random audits of its electronic medical records system as part of its enhanced privacy and security measures.
The IPC has concluded no further review of the breach is necessary.
Maamwesying delivers primary health-care services to 11 First Nations in northeastern Ontario and the off-reserve population in Sault Ste. Marie.