The first custodial sentence for violating Alberta, Canada’s health privacy statute is a wake-up call to health-care workers and companies that oversee handling of personal health information, privacy officials told Bloomberg Law.
The Albert Court of Queen’s Bench sentenced former Covenant Health pharmacist Basel Alsaadi to limited confinement—three months of house arrest followed by three months of curfew—for improperly accessing personal health information in violation of the province’s Health Information Act. Alsaadi accessed the demographic information, diagnostic images, and laboratory results of 104 patients.
The court’s sentence is “sending a message to not only Mr. Alsaadi but any others that patient information is very important and privacy rights are extremely important,” Justice R.P. Belzil said at the sentencing hearing. The verdict was handed down Oct. 16 from the bench, but notice of the ruling was only made public Nov. 15.
The case is only the eighth conviction for inappropriate access to personal health information since the health privacy law took effect in 2001, according to the privacy office statement announcing the sentencing.
Megan Rosborough, a prosecutor in the Alberta Department of Justice’s specialized prosecutions branch in Edmonton who handled the case, told Bloomberg Law that she’s not aware of any other sentences that included a custody sanction for Health Information Act violations.
Although private records snooping cases often arise in the health-care industry, this case is notable because of the higher-than-usual penalty, David Fraser, privacy partner at McInnes Coope in Halifax, told Bloomberg Law.
“It ups the stakes for the consequences of inappropriately accessing health information,” Fraser said. As little as 10 years ago, there weren’t privacy laws with criminal provisions, but “the tendency now is stricter enforcement and greater punishment,” he said.
The province has a data breach notification provision in its health law that would require health-care employers to report unauthorized access to medical records, but the implementing rules haven’t been finalized.
Although the Alsaadi case shows that the province takes health-care privacy seriously, it also highlights that the mandatory breach reporting and notification provisions for personal health information aren’t in effect, despite breach notice amendments to the Act that were passed in May 2014, Alberta Information and Privacy Commissioner Jill Clayton told Bloomberg BNA.
“Snooping into health records is not only unethical, it’s against the law,” Clayton said. Having the breach notice law fully in place would reinforce that message, she said.
Alsaadi still faces an ongoing internal disciplinary process on unprofessional conduct allegations, Alberta College of Pharmacists spokesman Barry Strader told Bloomberg Law.
To contact the reporter on this story: Peter Menyasz in Ottawa at firstname.lastname@example.org
To contact the editor responsible for this story: Donald Aplin at email@example.com