Nunavut privacy boss says privacy not a priority for GN Health

Colleen Stockey, deputy minister of health for the Government of Nunavut, responds to MLAs during committee hearings into a 2016 privacy audit of the Qikiqtani General Hospital which found multiple breaches of patient privacy. (PHOTO BY STEVE DUCHARME)

Elaine Keenan Bengts, Nunavut’s Information and Privacy Commissioner, at committee hearings this week at the Nunavut legislature. Keenan Bengts answered questions from MLAs about her 2016 privacy audit of the Qikiqtani General Hospital in Iqaluit. (PHOTO BY STEVE DUCHARME)

Nunavut’s privacy czar says she’s “encouraged” with the steps taken by the territory’s health department to address glaring security issues and privacy shortfalls at the Qikiqtani General Hospital in Iqaluit, following the release of a highly critical audit late last year.

But that praise didn’t stop Nunavut’s Information and Privacy Commissioner, Elaine Keenan Bengts, from suggesting the department’s lack of communication on the matter proved privacy was not it’s top priority.

Keenan Bengts told a standing committee of Nunavut MLAs that she has heard nothing from the Department of Health since her report was tabled last fall.

“There was no comment from the department until one week ago, when I received the department’s response to the recommendations made,” Keenan Bengts said May 10, during two days of televised hearings to review the 70-page report at Nunavut’s legislature.

Fax machines printing off sensitive medical data in public hallways, computers left idle, lackluster security for medical records and even employees unofficially accessing their own medical data, were some of the more egregious violations noted by Keenan Bengts during her two days of testimony.

The commissioner submitted 31 recommendations following her audit, calling for MLAs to enshrine patients’ privacy rights in standalone health information legislation, shifting fully to electronic records, and creating a dedicated privacy officer position at the hospital.

Deputy minister Colleen Stockley told the standing committee that the health department accepts all of the audit’s recommendations, and is currently drafting health information legislation that will be introduced for consideration by Nunavut MLAs, “very early into the next government.”

Territorial elections are scheduled for this October.

“We never did intend to leave it to the week before to respond to the privacy commissioner,” Stockley told the standing committee, adding that her department takes the commissioner’s work very seriously.

“We were working on all of her recommendations… we probably didn’t respond as quickly as we should have but we were moving fax machines and putting directives in place and doing work that needed to be done to address some of the concerns.”

Stockley clarified to MLAs that the health department had drafted directives for health information policy as early as 2009—but they were never implemented, as uncovered by Keenan Bengts in her report.

She also said that shifting the territory’s health records entirely to electronic formats is at least five years off but noted that 13 community health centres have been fitted so far with an electronic medical record system called Meditech.

That will allow health centres to document treatment to patients that can be accessed via the system, but they will still rely on paper records for a complete health record.

Keenan Bengts reported she learned through staff at the Qikiqtani General Hospital in 2016 that some employees had searched medical histories through the Meditech system—a clear violation of privacy norms.

“There are undoubtedly incidents of employees looking up the records of friends and relatives,” the report noted.

Stockley told the standing committee that security at the QGH has been improved since the report, with protections for both electronic systems and controlled access to the medical file storage area.

The health department expects to install the Meditech system in all communities by the end of the year, she added.

“I had received very few formal complaints regarding QGH, which was in stark contrast with many other jurisdictions where privacy complaints are common,” Keenan Bengts said, explaining why she decided to focus her audit on the hospital.

Part of that, she said, was because the hospital had no dedicated privacy officer to oversee information protection and privacy awareness for patients and staff.

Currently, two employees split that task between themselves but Keenan Bengts explained that the job requires highly specialized skills and can’t be done in a part-time capacity.

“It’s not the fix the hospital needs,” she said.

Stockley responded that the health department had advertised in the past for a privacy officer position, but no suitable candidates were found.

“If there’s one recommendation that I would put above all in the 31 recommendation that we made, I think the most important recommendation is the appointment of a chief privacy officer within the hospital,” Keenan Bengts said in her closing statements.

“That person will take care of almost everything else in this report.”

Prior to Keenan Bengts appearance before the standing committee, Nunavut MLAs examined another health-related audit earlier in the week—a full audit of the Department of Health by the Auditor General of Canada.