Your personal health information must be easily accessible to you

An individual requested a copy of their ultrasound and were told that they could only access the information through the PocketHealth app. When they logged into the app, they were prompted to sign up for a recurring payment of roughly $50 per year. The individual had concerns with this fee and the fact that the app contained their medical imaging information dating back to 2014. 

To charge or not to charge a patient to access their personal health information

We received two complaints about a doctor who was closing their practice and charging fees to transfer patient records to another clinic. The Complainants wanted to know whether the Custodian was allowed to charge these fees under the Health Information Privacy and Management Act (HIPMA). 

Public bodies must be transparent about how they collect, use, and disclose personal information[

We received a complaint alleging that the Public Body disclosed personal information without authority under the Access to Information and Protection of Privacy Act (ATIPPA). 

When the Complainant participated in one of the public body’s proceedings, they were required to give their name and email address along with their comments about the utility’s application. A short time later, the Complainant received a notice from the Public Body advising them that their personal information and comments were now posted on the Public Body’s website as part of the proceedings. 

The Complainant claimed they were never advised that their personal information would be disclosed in this manner and felt this might be a violation of the ATIPPA. 

Sharing email addresses without authority is a privacy breach

An individual received a mass email from the Authority’s Land Management Branch that revealed their email address, as well as those of the other recipients. They contacted our office because they felt that their privacy and that of the other recipients had been breached.

Doing the right thing with a privacy breach

The custodian allegedly disclosed the complainant’s personal health information (PHI) to their emergency contact.

The custodian had investigated the complainant (the parent) due to a reported child protection concern that was quickly determined to be unfounded. They intended to phone the parent to report that the file was now closed but accidentally phoned the parent’s emergency contact who has the same name. When they identified that they were calling from Family and Children’s Services about their child, the emergency contact stated that they did not have a child.

Parents are not entitled to their adult child's health information

The custodian shared the complainant’s highly sensitive personal health information (PHI) with their parents who were not listed as their emergency contacts.

The complainant pointed out that, unless there is consent, under section 59 of HIPMA a release of PHI to an immediate family member is limited to their name, general health condition and location. The complainant alleged that the PHI disclosed by the custodian far exceeded this information.

Your personal information has been served to someone else

The Sheriff’s Office served a confidential document containing the complainant’s personal information to a relative’s house when they were not there. The document was not in an envelope and was left in plain view in a common area of the house where guests were present.

Adequate does not mean every record

An individual complained that they did not receive every record related to their access to information request from the public body. The complainant had personal knowledge of correspondence between two employees that they felt should have been included in the responsive records, but it was not.

Sharing health information without consent, twice

We received a complaint from an individual alleging that the Custodian disclosed their personal health information (PHI) to their ex-partner.

Securely collecting health information

An individual filed a complaint with our office alleging that the Whitehorse Health Centre, operated by the Custodian, does not have a secure alternative to email or fax for individuals to submit their access requests for immunization records. The complainant was concerned with the security risks associated with this.