What is: A Privacy Breach

Why is this important and what’s my role in this?

At Health we handle a great deal of personal information.  This is information that identifies an individual and can include patient and staff information.

We have a duty to handle personal and confidential information respectfully, and in accordance with the law. We build the trust of the public by respecting privacy.

Inappropriate handling of personal and confidential information is a serious matter and can result in disciplinary action, dismissal and even referral to the police for prosecution under the Criminal Code.

How do privacy breaches occur?

A privacy breach occurs when we have not:

• handled information in accordance with the Information Privacy Act and National Privacy Principles.
• Met obligations under Part 7 of the Hospital and Health Boards Act around confidentiality and disclosure of patient information.

The most common type of privacy breach is when we have not secured information adequately and it is disclosed to the wrong people. Examples:

• A patient discharge summary being posted to the wrong address.
• An email containing HR information being sent to the incorrect recipient.
• Leaving a computer screen containing patient information unlocked when you step away from your desk.
• Audits revealing staff accessed electronic systems like ieMR or CIMHA without having a work-related reason.

What do I need to do?

In addition to keeping personal information secure, we have obligations to:

• make sure that the personal information we use is accurate and up to date
• notify people that we are collecting their information and for what purpose
• only use that information for the stated purpose unless an exception applies.
• only collect personal information where we need it for our work functions.

For patient information we can only disclose it in accordance with the Hospital and Health Boards Act exceptions to confidentiality in Part 7.  For example, where it is for the ongoing care or treatment of the patient, or where the patient has consented.

When privacy breaches at Metro North Health have occured, they have been mostly well contained and managed. When a privacy breach occurs, it is important to react quickly when it becomes apparent that a breach has occurred. Breaches can harm individuals and damage our organisational reputation. Sometimes compensation is payable.

If a Privacy breach is likely to result in harm to a person or organisation then then they may need to be notified of the breach, however this is not always the case. Contact your local Privacy Officer for assistance.

You must notify the Metro North Health Ethical Standards Unit if you suspect a Privacy Breach was deliberate.