Medical information of 283 CHEO patients shared by former instructor and hospital employee

A former part-time instructor at Algonquin College and an employee at the Children’s Hospital of Eastern Ontario breached privacy rules by using the unaltered medical information of 283 patients as part of an in-class lesson, the hospital said. 

CHEO’s chief privacy officer sent a letter to the parents of the 283 patients in early March explaining what happened in early February. 

According to the hospital, a part-time instructor at Algonquin and CHEO employee gave a group of 32 students handouts containing a list of hospital operating procedures containing the name, date of birth, medical registration number, surgical procedure, allergies, gender and age. The hospital said the information was meant as a teaching resource during class time and was only available to students for less than an hour. 

“The lists did NOT have: patient addresses, OHIP numbers, nor any chart notes beyond what is listed above,” a spokesperson for CHEO wrote in an emailed statement. 

“The use of medical information in this way was not permitted by CHEO or Algonquin College. Both organizations share a commitment to the protection of confidential information in their custody,” the statement read. 

In the letter to parents, the hospital’s chief privacy officer said the information may have been seen by up to 8 students before the handout was returned to the teacher, and ultimately CHEO.

The instructor in question came forward after the incident and reported what occurred on February 1 and 2, 2017. Alongquin College said the instructor is no longer with the school. 

An investigation is being conducted by both the hospital and the college. Both institutions said the students in question have been spoke to. 

 

Full letter from CHEO to parents: 

Dear [Patient/Parent],

At CHEO, privacy is of the utmost importance. Patients and their families need to feel they can safely share personal information with their healthcare providers so you receive optimal care. This is our top priority, and when we don’t meet our own high standards, we need to tell you why and what we’re doing about it.

That is why I am writing you today. We were informed by Algonquin College on February 17, 2017 that some medical information was briefly shared by a part-time instructor with students enrolled in the College’s Faculty of Health, Policy & Public Safety and Community Studies. The instructor in the program is a CHEO employee who has access to such information through their role with CHEO. The individual was not permitted to use medical information in this way by either CHEO or by Algonquin College. We take this very seriously and are taking all necessary steps to prevent this from happening again.

Your child’s name, date of birth, Medical Registration Number, surgical procedure, allergies (if any), gender & age, and pertinent information related to the surgery (if any) appeared on an Operating Room Schedule. The instructor used parts of the schedule as handouts, which were intended as a learning tool to teach future health professionals how to support surgeries in a hospital setting. These handouts were given to a total of 32 students over two classes. We believe your information may have been seen by up to 8 students before it was returned to the teacher, less than an hour after it was handed out. We have confirmed that all copies were returned to the instructor and have now been recovered by CHEO.

We have worked together with Algonquin College to contain and investigate this breach. Students who saw the material have been contacted, have been reminded of the information’s confidential nature, and those interviewed by Algonquin College have confirmed that the information did not leave the classroom.

CHEO offers you our sincere apologies. This should not have happened. We are committed to making sure it does not happen again and we are working together with Algonquin College to take steps to prevent similar incidents in the future.

We have contacted the Office of the Information and Privacy Commissioner of Ontario to notify them of this privacy breach and are working with them to ensure that we respond fully and appropriately. If you wish to file a complaint about this breach of privacy with the Information and Privacy Commissioner of Ontario, you are entitled to do so. You can reach the Commissioner at: 

Registrar

Information and Privacy Commissioner of Ontario

1400-2 Bloor St

Toronto, ON, M4W 1A8

Tel: [phone]

 

In the meantime, if you have any questions or concerns, please do not hesitate to call me.

Yours truly,