Estranged wife accessed husband’s medical records

A sergeant stationed at a Canadian Forces Base complained that his military health records had been accessed without authorization by his estranged wife, who was employed as a civilian at the Base.

The sergeant provided a copy of a report from the system audit log of the Canadian Forces Health Information Services (CFHIS) which recorded when his medical records had been accessed by his estranged wife.

National Defence (DND) confirmed that the estranged wife had accessed the sergeant’s CFHIS account and deleted a physiotherapy appointment scheduled for him at the base health services centre. DND also advised our Office that the estranged wife had been observed accessing a paper physiotherapy file about the sergeant which was in a protected folder.

Because the estranged wife had been fully informed of the criteria for acceptable use of CFHIS electronic records, DND determined that she had willfully breached the department’s rules and regulations. National Defence applied system restrictions automatically barring her access to the sergeant’s CFHIS medical files.

The access and use of the sergeant’s medical information is clearly inconsistent with the purpose for which the information was originally intended and does not meet one of the permissible uses defined in the Privacy Act. Therefore we upheld the complaint as well founded.

DND informed our Office that it has implemented new CFHIS controls to deal with improper access. The department also advised us that it is evaluating the systems and practices that apply to collection, retention, use and disclosure, as well as the overall security of CFHIS files.