NL Health Services Advises of Privacy Breach

Newfoundland and Labrador (NL) Health Services today advised of a privacy breach related to the distribution of an email to 116 fertility patients. The recipients of the email were inadvertently not blind copied, allowing all who received it to view the email addresses of other fertility patients.

“NL Health Services sincerely regrets this error and I apologize to all of the patients whose privacy was breached through this incident,” said David Diamond, President and CEO of NL Health Services. “As an organization, we take our responsibility as a custodian of personal health information very seriously. It is a priority to make sure our employees and physicians are aware of their obligation for protecting the information of our clients, patients and residents.”

NL Health Services has identified all patients who have been impacted by the privacy breach and is in the process of contacting them and requesting that recipients delete the email and email addresses. The Office of the Information and Privacy Commissioner has also been notified by NL Health Services.

“NL Health Services has many measures in place to protect patient health information and we are always looking for ways to improve and enhance privacy practices,” said Stephen Greene, Vice President Responsible for Privacy. “We will continue to work on ensuring proper protocols are followed with mass communication and reinforce awareness among health-care workers of their obligation to maintain the privacy of our patients, residents and clients.”

NL Health Services has established a number of policies and initiatives for employees and physicians related to privacy and confidentiality, including:

• the signing of an employee oath of privacy and confidentiality;
• a Personal Health Information Act education program;
• a Privacy and Confidentiality Policy and a Privacy Breach Management Policy;
• an annual Privacy Awareness Week; and
• notices to employees reminding them of their responsibility to help protect the privacy of patients, clients and residents.

-30-