Your Stories | Yukon Accountability

Doing the right thing with a privacy breach

The custodian allegedly disclosed the complainant’s personal health information (PHI) to their emergency contact.

The custodian had investigated the complainant (the parent) due to a reported child protection concern that was quickly determined to be unfounded. They intended to phone the parent to report that the file was now closed but accidentally phoned the parent’s emergency contact who has the same name. When they identified that they were calling from Family and Children’s Services about their child, the emergency contact stated that they did not have a child.

Parents are not entitled to their adult child's health information

The custodian shared the complainant’s highly sensitive personal health information (PHI) with their parents who were not listed as their emergency contacts.

The complainant pointed out that, unless there is consent, under section 59 of HIPMA a release of PHI to an immediate family member is limited to their name, general health condition and location. The complainant alleged that the PHI disclosed by the custodian far exceeded this information.

Your personal information has been served to someone else

The Sheriff’s Office served a confidential document containing the complainant’s personal information to a relative’s house when they were not there. The document was not in an envelope and was left in plain view in a common area of the house where guests were present.

Adequate does not mean every record

An individual complained that they did not receive every record related to their access to information request from the public body. The complainant had personal knowledge of correspondence between two employees that they felt should have been included in the responsive records, but it was not.

Sharing health information without consent, twice

We received a complaint from an individual alleging that the Custodian disclosed their personal health information (PHI) to their ex-partner.

Securely collecting health information

An individual filed a complaint with our office alleging that the Whitehorse Health Centre, operated by the Custodian, does not have a secure alternative to email or fax for individuals to submit their access requests for immunization records. The complainant was concerned with the security risks associated with this.

Personal information posted on social media

An individual filed a complaint with our office because their name, place of residence, and details about their recent conviction under an Act was posted on social media by the Public Body. The complainant requested the Public Body remove or amend the post, but it declined.

"Out of scope" is not a provision of ATIPPA

Our office received a complaint about an access request for briefing notes that was refused by the Public Body based on several ATIPPA provisions.

Incomplete release of information

Our office received a complaint from an individual who alleged that the Respectful Workplace Office (RWO), a branch of the Public Body, did not provide a complete response to their access request. The applicant received 1,300 pages of responsive records (all of them redacted) but was concerned that additional responsive records weren’t provided.