Posted at 5:00 am.
Hugo Jonca’s investigative team, La Presse
Repeated burglaries
Véronique Cloutier has not set foot in the Pierre Boucher hospital in Longueuil since an operation eleven years ago. However, the traffic in his medical record never stopped. Eleven people have since consulted it for no apparent reason.
“I’m not upset. But I find it worrying, I find it clearly too easy,” laments the television and radio star.
Véronique Cloutier has agreed to assist in La Presse’s investigation into breaches of medical record confidentiality. Quebec does not measure the phenomenon, but it affects thousands of patients, as evidenced by the decisions made by professional bodies and the fragmented responses to our dozens of requests for access to information. In the Sainte-Justine Mother-Child Hospital Center in Montreal and the Integrated Health and Social Services Center (CISSS) in Gaspésie alone, more than 2,500 people have been victims of such procedures in recent years.
PHOTO FRANÇOIS ROY, LA PRESS ARCHIVE
Pierre Boucher Hospital in Longueuil
At our request, Véronique Cloutier requested access to the “diary” of her medical file at the Pierre Boucher Hospital: the list of people who had access to the medical information held about her.
During our interview, the presenter, producer, entrepreneur and philanthropist goes through the document. “Why would anyone consult my record at the hospital in 2020, 2021, 2022 when I haven’t set foot there since 2012? It strikes me as surprising and unnecessary. »
Several visits to Véronique Cloutier’s file over the past few years also raise questions, she said.
For example, in the two months following her last delivery in October 2009, no fewer than 16 people looked at their medical records. Five nurses, five administrators, three doctors, two trainees… “Everyone knew I had just had a baby in the hospital. It was in the media. Is it tempting to look at it? »
One respiratory therapist in particular consulted her medical information four days after her daughter was born. “I don’t understand: I wasn’t there anymore! “, She says.
Ongoing investigation
Véronique Cloutier’s approach, commissioned by La Presse, caused a stir at the CISSS de la Montérégie-Est. An investigation into these accesses is ongoing. In particular, it should be determined whether certain culpable employees are also responsible for breaches of confidentiality in the medical files of other patients.
About 20 employees have viewed data on Véronique Cloutier over the years for no apparent reason. A dozen of them are still employed in the company.
Steps continue, but so far the CISSS has confirmed “two confirmed cases of unfair access”. Even before they were fired for their “deviant behavior,” the affected employees resigned on Wednesday, CISSS spokeswoman Caroline Doucet said.
No fewer than 17 accesses to Véronique Cloutier’s medical records were made after her last visit to Pierre-Boucher in May 2012 for post-operative care. One of these in June 2022 would be an honest mistake and the nurse concerned will not face any consequences in her opinion. Some employees and archivists have also had the opportunity, for legitimate administrative reasons, to inspect his file.
In a meeting with Véronique Cloutier’s assistant, CISSS Deputy Director for Multidisciplinary Services Marie-Hélène Côté assured that the organization takes the situation “very, very seriously”.
“disturbing”
If a patient wishes to see the logs of his medical file, the documents are usually sent to him by e-mail or post without further ado. This time, the establishment instead wrote to Roseline Leclair, who was in charge of the star’s proceedings.
From the tone of the email, she immediately sensed something was wrong. “We would be happy to arrange a personal or virtual appointment for you to present the results to you,” wrote Marie-Hélène Côté.
Some employees met admitted their wrongful access to Véronique Cloutier’s file, but made sure they did not disclose the information to anyone. The manager agrees that these statements should be treated with caution. “There is no employee who admits to having disclosed information,” says Marie-Hélène Côté. However, if you ever think someone has disseminated data, we will go back and question the person further. »
As part of its investigation, La Presse granted access to information requests to all organizations that oversee Quebec hospitals to find out how many unwarranted consultations had taken place on their patient records. Most had no answer, such as the CISSS de la Montérégie-Est responsible for Pierre-Boucher. However, the facility clarified that since April 2020, “ten files of breaches of confidentiality” had resulted in “disciplinary action.”
“It’s really worrying,” says Cynthia Chassigneux, a lawyer at Langlois, former commissioner of the Commission d’accès à l’information and author of the organization’s decision on the massive data theft at Desjardins.
“It proves that Pierre-Boucher’s system, and perhaps unfortunately that of many other hospitals, is not optimal for the protection of personal data,” she said. And it takes a special case to see that. »
Thousands of unjustified consultations
The Pierre Boucher Hospital is far from the only one affected by such problems. In December, La Presse reported that four staff members at the Sainte-Justine Maternal and Child Hospital Center accessed 1,366 medical records “out of sheer curiosity”. The affected patients are well-known personalities or one of their relatives.
Hospitals across Quebec have registered thousands of unwarranted medical record searches. To understand the phenomenon, La Presse had to submit dozens of requests for access to information and consult as many files in the registry offices.
In Gaspésie, for example, a registered nurse who was laid off for five months collected no fewer than 2,339 unlawful accesses to the medical records of relatives, colleagues, acquaintances and personalities in her region, according to her disciplinary board.
“You feel your privacy has been violated”
In her personal case, the consequences of breaching confidentiality are not very serious, says Véronique Cloutier. “I don’t really have any secrets,” she says. But what if she had cancer, which she wanted to keep quiet about?
Or even worse: “If I go to the hospital because I tried to kill myself? Then I’m not allowed to say it because I don’t want my superiors to know? she illustrates. I’m doing a project where I’m trying to spread joy, and then I don’t want people to know about the inner struggle I’m fighting…”
PHOTO FRANÇOIS ROY, THE PRESS
Véronique Cloutier, with our journalist, takes stock of what the logging of her medical file at the Pierre Boucher hospital reveals.
However, she has no intention of filing a complaint. “I think your investigation will do the trick,” she explains.
The presenter and producer hopes that this file will prompt the government to introduce stricter and more systematic measures to control access to medical information.
“What right does anyone have to go into your file, know that and tell it at their Christmas party?” asks Véronique Cloutier.
She is able to imagine the fascination that the major figures in Quebec show business have on the public. Not only is the star one of them, but she just hosted The Rumor Machine, a documentary series about Quebecers’ relationship with public figure gossip.
On the sidelines of her 2022 show, she admitted in an interview with Radio-Canada that she herself once played the role of “Gossip Powerhouse.”
PHOTO FRANÇOIS ROY, THE PRESS
It seems I understand each person individually who has dug into my file unnecessarily. What hurts is the accumulation, it’s that these people seem to forget they’re not the only ones. Here you feel violated in your privacy.
Veronique Cloutier
While working on The Rumor Machine, Véronique Cloutier thought a lot about the reasons people gossip based on personal information.
The mother-of-three believes one of the ways health workers use medical records to compare themselves. “You can say to yourself, ‘She had a C-section like me!’ Oh, her too, she needed three PDAs for that!” »
In her opinion, many people use this information to get in touch with others. “I have information you don’t have, that makes me interesting to you. »
Department requirements for overseeing access to medical records
The Department of Health and Human Services (MSSS) has no direct control over what hospitals do or don’t do to monitor their staff’s access to patient records. However, Quebec requires businesses to specifically take the following actions:
- have a procedure for adding, reviewing and removing access to patient records;
- implement an access logging tool (keeping a list of employees who entered medical records);
- Conduct cybersecurity training to raise employee awareness.
Puzzles about violations of medical confidentiality
In recent years, as the government prepares to centralize the medical records of all Quebecers, thousands of people’s files that should remain classified have been unlawfully accessed. How much exactly? Secret. Larger healthcare organizations do not collect data about data breaches. So does the Department of Health, in contrast to Ontario, which attempts to count the “violations of privacy” in its health care system each year.
La Presse made dozens of requests for access to information and reviewed the documents of professional orders. Without giving exact numbers, our research suggests that for thousands of patients, medical confidentiality is just… not that secret.
PHOTO ALAIN ROBERGE, LA PRESS ARCHIVE
The government cannot say how many Quebecers saw their basic right to medical confidentiality violated in hospitals.
The government cannot say how many Quebecers saw their basic right to medical confidentiality violated in hospitals. “I realize it’s sub-optimal,” says Marc-Nicolas Kobrynsky, associate minister for strategic planning and performance at the Department of Health and Human Services (MSSS).
The larger it is, the less information there is
The largest organizations in the healthcare network had no data to send us. Most of them had figures that were incomplete, unusable, or simply non-existent.
“We don’t have an automated mechanism to compile this data for you,” explains Andrée-Anne Toussaint, spokeswoman for the Center hospitalier de l’Université de Montréal. The establishment has not sent any document that would give it the slightest idea of the frequency of interventions on the medical records of its patients.
The same blind spots at McGill University Health Center and CIUSSS de l’Estrie – Center hospitalier universitaire de Sherbrooke.
Among the flagships of health, only the Center hospitalier universitaire de Québec (CHUQ) was able to provide La Presse with figures on this subject for the years 2019-2020 to 2021-2022. Useless numbers.
According to the institution, users of its medical record system have abused their access 263 times to see “their own test results and their medical records” or those of “their relatives or a colleague”.
In short, the CHUQ lumps together the nurse who searched the medical record of a third party she has not treated and the one who short-circuited the usual channels, but only to see her own information.
When La Presse asked for separate figures, Jean-Thomas Grantham, CHUQ’s assistant to the CEO for public affairs, replied that it was impossible and that the establishment saw no need for it.
“In our view, the segregation of this data is not relevant as both cases are a violation of our policies […] It states: “It is forbidden to view, distribute, disclose or print information about users, regardless of whether it is one’s own file, that of one of their relatives or that of another person.”
However, the law requires a close account of these events. “Unauthorized access to personal data constitutes a confidentiality incident that has had to be registered since September 2022,” stresses Jorge Passalacqua, Communications Director of the Commission d’accès à l’information (CAI).
Who can see medical records?
A priori all employees who are subject to a professional code, as well as archivists, custodians of these data and certain members of the administrative staff. In principle, however, hospital staff must have a clinical reason for inspecting a medical record. “This access to information is crucial in a context where a patient will inevitably have to deal with multiple professionals who take turns during the care episode,” explains, for example, Justine Lesage, spokesperson for the Center hospitalier de l’Université de Montreal.
“No leverage,” says Quebec
However, hospitals are not accountable to the Ministry of Health. “I don’t even have the opportunity to give an account on this page,” said Deputy Minister Marc-Nicolas Kobrynsky. I can’t. »
On Monday, Deputy Health Minister Dominique Savoie sent a letter to all public health managers, reminding them of “the importance attached to the confidentiality of the personal data used”.
“Regular audits must be carried out, with corrective measures in the event of inappropriate inspection of these assets,” said the letter, seen by La Presse. The senior official adds that healthcare organizations “need to put in place mechanisms to limit access to this information.”
New laws
The new Law 5 (ex-Bill 3, passed March 30), aimed at facilitating and controlling the exchange of medical information between institutions, must herald the end of the pause, says Marc-Nicolas Kobrynsky. In particular, it will impose criminal penalties on those who consult medical records without justification. The law will come into full force next year.
Currently, healthcare facilities rely primarily on professional orders to prosecute criminals who search medical records without good reason.
“We can file a complaint directly with the Director of Law and Law Enforcement,” Mr. Kobrynsky said.
According to the CAI, the sanctions are insufficient
However, fines will not exceed $100,000 per violation for an individual and $150,000 for an organization. Not nearly enough for the Commission d’accès à l’information. In comparison, the “Law 25” passed last autumn for the protection of data outside the health network provides for fines of up to 25 million for private companies.
“The Commission is concerned about the message this decision sends about the importance of protecting health information in Quebec,” said Jorge Passalacqua, communications director at the CAI.
In Ontario, fines for breaches of medical confidentiality can be as high as $1 million.
The Commission also regrets that Bill No. 5 does not allow it to take action itself against breaches of healthcare confidentiality, as is possible with other public and private bodies.
Learn more
11,263 Number of “data breaches” recorded in the Ontario healthcare system in 2021.
Source: Ontario Information and Privacy Commissioner