Saskatchewan Information and Privacy Commissioner Grace Hession David found that a privacy breach involving an employee at the Dr. F.H. Wigmore Regional Hospital did take place.\u00a0<\/p>\n
The decision found that a unit clerk in the emergency department inappropriately accessed their own health records as well as the records of 98 other people a total of 102 times between July 2024 and June 2025.\u00a0<\/p>\n
The commissioner said that, in at least two instances, the employee shared what they had learned from those records with others, including telling a co-worker about private health information and texting a family member about another relative being admitted to hospital.\u00a0<\/p>\n
The Saskatchewan Health Authority became aware of the breach when the employee approached a co-worker and asked about information related to a recent hospital stay that had been kept strictly private.\u00a0<\/p>\n
The conversation was reported to a manager, who believed a privacy breach had occurred.\u00a0<\/p>\n
Why it was a privacy breach\u00a0<\/p>\n
Under Saskatchewan law, health-care workers may only look at patient information if they need it to do their job. Curiosity,\u00a0concern\u00a0or personal interest\u00a0is\u00a0not\u00a0permitted, including accessing one\u2019s own record.\u00a0<\/p>\n
The commissioner found the employee was snooping and had no legal authority to view their own health information in the system, access the information of 98 other people, discuss a co-worker\u2019s private medical\u00a0information\u00a0or share patient information with family members.\u00a0<\/p>\n
In response, the Saskatchewan Health Authority investigated the complaint, conducted a detailed audit, and\u00a0suspended\u00a0and then fired the employee.\u00a0<\/p>\n
The authority also notified all affected individuals in writing, reported the breach to the privacy commissioner, and added stronger privacy training and confidentiality agreements.\u00a0<\/p>\n
The commissioner noted that the authority did not suspend the employee\u2019s access quickly enough, allowed access for longer than necessary after warning signs appeared, and did not have a proactive audit system that might have detected the snooping earlier.\u00a0<\/p>\n
The commissioner found the employee knowingly and deliberately violated the law despite completing multiple privacy training sessions, signing confidentiality pledges, and knowing there were clear rules restricting record access without a need to know.\u00a0<\/p>\n
In submissions to the commissioner, the employee admitted they knew accessing the records was wrong.\u00a0<\/p>\n
\u201cI was totally in the wrong for checking my co\u2011workers\u00a0record\u00a0but I did it out of compassion as I genuinely care about my co\u2011workers,\u201d the employee wrote to the privacy commissioner.\u00a0<\/p>\n
The employee admitted they were \u201ca fool\u201d and should have \u201ckept my mouth shut,\u201d and said they did not mean to upset their co\u2011worker and apologized for their actions.\u00a0<\/p>\n
Case not referred for criminal charges\u00a0<\/p>\n
The commissioner decided not to refer the case to the Attorney General to pursue charges, citing the employee\u2019s termination, the lack of formal complaints from affected individuals, limited harm, and the cost of prosecution\u00a0relative\u00a0to the public interest.\u00a0<\/p>\n
Two recommendations were issued by the commissioner. David recommended the authority\u00a0immediately\u00a0suspend access to records when there are signs of inappropriate record viewing and introduce proactive monitoring and auditing of electronic health records to detect snooping earlier.\u00a0<\/p>\n