National Defence employee accesses someone’s personal health records for her own personal reasons

A complainant alleged that his personal health information was accessed inappropriately by a Canadian Forces (CF) employee with whom he had a prior personal relationship.

Our investigation revealed that the employee accessed the complainant’s health information held in the Canadian Forces Health Information System (CFHIS) numerous times after receiving an anonymous message, advising that the complainant was “sick” and as a result, her own health was at risk.

The employee admitted to accessing and using the complainant’s personal information for her personal reasons, which were clearly inconsistent with the purpose for its collection and the complaint was well founded.

As a result of our investigation, National Defence (DND) acknowledged the importance of a comprehensive and up-to-date privacy awareness and training process for its employees. DND advised that it has implemented new controls in the CFHIS to deal with improper access, it has updated the Canadian Forces Health Service policy on appropriate use and disclosure of personal health information, and it has provided training to CF heath care staff on patient privacy.