I’m Kate Dewhirst.

I’m a lawyer who writes about legal issues affecting healthcare in Canada

Kate Dewhirst Health Law - bringing the law to life. Meet Kate (in 13 seconds)

Training is your best weapon to guard against fraud – New privacy decision released every health care organization in Ontario needs to read

Posted by

Last Friday, the Information and Privacy Commissioner of Ontario released two new health privacy decisions.

Decision 68 reads like a made for tv movie. It’s a doozy.  Hold on to your socks.

The facts are complicated. I’ll try to simplify the back story.

Back Story

A patient complained that her former spouse (a physician) was given her health information from her physician’s office and a pharmacy.

The spouse was also a former physician of the clinic where the patient’s doctor worked, The spouse came to the clinic after hours and asked the clinic’s administrative person to assist him to have copies of his ex-wife’s health information saying that he had the patient’s physician’s permission. The spouse also accessed information at a pharmacy by making it look like he was the prescribing physician for the patient.

The spouse used the health information received from the clinic against the patient in court proceedings related to their children. He said to the IPC he needed the information in order to prevent serious harm that that patient posed to herself and their children.

There are allegations of fraud and other criminal conduct that were reported to police and the College of Physicians and Surgeons of Ontario. Including allegations that the spouse forged a letter from the physician about the patient and shared that letter with the courts and the Children’s Aid Society. The criminal issues and fraudulent letter allegations fell outside the scope of the IPC’s decision.


The IPC found:

  1. The clinic was responsible for disclosing the patient’s information to the spouse without authorization. The administrative employee did so under a mistaken understanding the patient’s physician agreed to it and the IPC found the admin person assisted the spouse and should have prevented the disclosure.
  2. The patient’s physician, an employee of the clinic, was not responsible because the physician was not a health information custodian.
  3. While the spouse asked the hospital for additional information (by using the physician’s letterhead) – the records came to the clinic afterward and there was no evidence that the spouse was given the follow up documentation.
  4. The pharmacy released information to the spouse based on mistaken belief it was sharing to a physician within the circle of care.
  5. The spouse to be a “recipient” and that he misused and disclosed the patient’s information for unauthorized purposes.

The clinic failed to take reasonable steps to protect the patient’s health information in three ways: (1) lack of adequate training of staff; (2) no agreements with physicians who are acting as agents and (3) lax rules on sharing passwords for eMR access.

The IPC also commented on some general errors in the clinic’s policies:

  • Mischaracterization of the “circle of care” and consent
  • References to federal privacy legislation and freedom of information legislation that do not apply to the clinic

The IPC did not accept that there was potential harm that could have justified the former spouse’s actions.

Bottom Line:

Fraud is tough. You can’t insulate your team from someone who is intent on defrauding you and your team members. But you can train your team to PAUSE when they are uncomfortable and to seek advice before acting when they receive an unusual request.

You must have agreements with your team members so there is crystal clarity about who is the health information custodian and who are agents.  In this case, the clinic had not made it clear to its physicians that they were agents.

Your privacy policies matter.  Including random irrelevant content in your policies indicates that you do not have a robust privacy program.

Here is a summary of all 70 IPC decisions.

Calling all Privacy Officers – if you want basic Privacy Officer training or Advanced Privacy Officer training our next programs start in October and November 2018 respectively.



If you enjoyed this article please share it:

Previous and next posts from Kate:

Some of Kate’s recent and upcoming events

Primary care webinars: Employment Law Update & Legal Issues for EDs and Board members

Part of Kate’s monthly webinar series.

Our January program will address an employment law update for health leaders.
Full details of the 2021 webinar series and registration here.

Free healthcare privacy webinar - ask me anything!
the first Wednesday of every month

Free webinars - advance registration needed

Whether you're an experienced privacy officer or new in the field, pick Kate’s brain for free for an hour, in this live webinar. No charge, but you’ll need to register in advance.

Health Privacy Officer training
April 12, 19, 26, May 3, 10, 17, 24 2021

For Privacy Officers within healthcare organizations.

This course focuses on how to become a more confident privacy officer and gives you the tools to document your privacy program. Full details and registration here...

Osgoode Privacy and Information Management Course
Jan 18, 25, Feb 1, 8, 16,

Advanced privacy learning opportunity for lawyers, privacy officers and health leaders

Learn more about Canadian health privacy and information management More Details...

Advanced Health Privacy Officer training
June 2021

For Privacy Officers within healthcare organizations - now totally online

This course focuses on taking theory into practice and we do real life scenarios to build your Privacy Officer skills.
Full details and registration here.

Team Privacy Training Events
January 7, 8, 13, 26, 27, 29

For Primary Care clinics, Hospitals, Community Agencies, Schools, Police departments

Kate trains health professionals from many more health care organizations how being privacy-respectful can improve therapeutic relationships. More details...

Part X CYFSA Privacy Designate Course

For Privacy Designates in the child welfare sector including children's aid societies and indigenous children's well-being centres

We focus on how to implement Part X of the Child Youth and Family Services Act in your organization.
Full details and registration here.

Kate Dewhirst Health Law

Kate says:

My mission is bringing the law to life. I make legal theory understandable, accessible and fun! I’m available and love to work for all organizations in the healthcare sector across Ontario and beyond.

Subscribe to my mailing list and keep up to date with news:

Latest Tweets

[FEB 4 – WEBINAR SERIES] Ontario Health Teams - What primary care should be thinking about when working with commun… https://t.co/MYsceypT8r

09:01 AM Jan 15th

It’s that time of year again … annual statistical reporting to the Information and Privacy Commissioner of Ontario.… https://t.co/qJIZCmDdWw

12:49 PM Jan 14th

[APR 12] More than 100 people took this training with me last year and in total I've trained Privacy Officers from… https://t.co/C6IdNhcBEG

09:01 AM Jan 14th

contact details

P.O. Box 97010 Roncesvalles
Toronto Ontario M6R 3B3

(416) 855 9557