Son upset after learning a St. Joseph’s healthcare employee accessed his deceased mother’s information

UPDATED ON FEB. 10

A former Hamilton resident is angry after he received a letter from St. Joseph’s Healthcare that said an employee accessed his mother’s information almost two years after she died.

Arthur Gallant’s mother, Marilyn Gallant, passed away in April 2019. Before her passing, Marilyn spent time at a number of hospitals, including St. Joseph’s Healthcare in Hamilton.

Last week, Gallant received a letter of apology from the hospital, addressed to his mom saying a staff member reviewed some of her personal information.

The letter goes on to say that an investigation was launched and after meeting with the individual, they were advised that their actions were driven by a general sense of curiosity and that they did not copy or further disclose any information learned from their access.

But Gallant is frustrated with the way the hospital handled the breach. He says he lost all trust in the hospital as an institution. “St. Joesph’s website is littered with how important privacy and confidentiality is to the institution. There’s no proof that the employee didn’t share it outside of the hospital,” said Gallant.

St. Joseph’s Hospital won’t disclose the identity of the staff member who reviewed the information. Gallant says it’s ironic that the employee did not give his late mother the right to privacy but due to privacy laws, they maintain their right to privacy.

In the letter, the hospital says the staff member was disciplined and required to undergo additional privacy training. Gallant believes the employee should have been fired. “They breached the hospital’s policies and they broke the law. Just makes me wonder how that’s not grounds for termination,” said Gallant. “If a privacy breach driven out of curiosity isn’t grounds for termination, what is grounds for termination?”

CHCH News reached out to St. Joseph’s Healthcare and to the Information and Privacy Commissioner of Ontario (IPC) for an interview on Tuesday but both refused our request.

The IPC provided a statement to CHCH News that said in part, “Our office was contacted by St. Joseph’s Healthcare Hamilton about this privacy breach involving unauthorized access to patients’ personal health information by an employee on June 23, 2021. Given that our investigation is in progress, we are unable to provide further details at this time.”

The IPC said it is working with the hospital to examine the breach as well as the disciplinary action taken.

“Snooping is a serious issue that can erode patients’ trust and confidence in the health care system. In 2020, snooping accounted for 20 per cent of the self-reported health privacy breaches reported to the IPC,” stated the IPC.

According to the IPC, violators can face serious professional repercussions such as loss of employment, regulatory college sanctions, and fines of up to $100,000 for individuals and $500,000 for organizations.

“Health care professionals need to know that any kind of snooping behaviour, whether motivated by curiosity, personal gain, or even concern, is completely unacceptable and can have devastating consequences for themselves and the individuals who have been affected. Patient privacy is vital to maintaining Ontarians’ confidence in their health care system,” said the IPC.

Gallant says he will be taking legal action.