A hospital employee looked at my records without reason.

What to do if you learn that a health care staff member accessed your record without a legitimate purpose.

TL;DR

Snooping is a serious violation. The hospital's privacy officer is responsible for investigating it. The custodian must notify the patient, review audit logs, and in many provinces report to the commissioner. Penalties under PHIPA can include significant fines against the individual employee.

Step 1: write to the privacy officer

A written request to the custodian for a formal investigation usually asks for a review of all access to the record, with dates, employee names (redacted as required), and reasons for access. The custodian must respond within a reasonable time.

Step 2: ask about notification

Most health privacy statutes require the custodian to notify affected patients of snooping incidents. In Ontario, PHIPA also requires reporting to the IPC.

Step 3: the complaint route

If the response is inadequate, a complaint can be made to the provincial privacy commissioner (IPC Ontario, OIPC BC, OIPC Alberta, CAI Quebec, etc.).

Sources & References

Personal Health Information Protection Act, 2004 (PHIPA Ontario)—Ontario's health privacy statute governing the collection, use, and disclosure of personal health information by health information custodians.Ontario.ca
Health Information Act (HIA Alberta)—Alberta's health privacy statute governing the collection, use, disclosure, and protection of health information by custodians.King's Printer of Alberta
Health Information Protection Act (HIPA Saskatchewan)—Saskatchewan's health privacy statute governing the handling of personal health information by trustees.Queen's Printer Saskatchewan
Personal Health Information Act (PHIA Manitoba)—Manitoba's health privacy statute establishing rules for the collection, use, disclosure, retention, and destruction of personal health information.Manitoba Laws
Personal Health Information Act (PHIA Nova Scotia)—Nova Scotia's health privacy statute governing the handling of personal health information by custodians including hospitals, physicians, and pharmacies.Nova Scotia Legislature
Personal Health Information Act (PHIA Newfoundland and Labrador)—Newfoundland and Labrador's health privacy statute governing personal health information held by health information custodians.House of Assembly Newfoundland and Labrador

All sources link directly to official government websites. This page provides legal information, not legal advice. Consult a qualified professional before acting on any information presented here.

A hospital employee looked at my records without reason.

Step 1: write to the privacy officer

Step 2: ask about notification

Step 3: the complaint route

Related topics