Whether you are an insurance company, hospital or patient, a medical information privacy case in Canada last month illustrates how important is the quality of an organisation’s compliance infrastructure and its response to any breach of such sensitive personal information.

In the Ontario case, a hospital reported to the privacy commissioner three separate medical information privacy breaches under that province’s version of Bermuda’s Personal Information Protection Act 2016. Each involved unauthorised access to a patient’s personal medical information by employees of the hospital who had, in the words of the privacy commissioner, “snooped” those records for non-work-related purposes.

The number of such distinct wrongful access incidents suffered by the hospital aroused the privacy commissioner’s concern that such surreptitious snooping might be systemic across the hospital’s staff so she agreed to hear the complaint against the hospital.

By comparison, under Pipa, all such medical information is defined as sensitive personal information which must be used only for the consented purposes for which it was collected by the retaining organisation.

It must be securely kept to a standard of “safeguard” from unauthorised access that must take into account the likelihood and severity of the harm threatened by any such unauthorised access or misuse, the sensitivity of such personal information and the context in which it is held.

A possible contextual consideration for any hospital is the reasonable patient expectation of confidentiality for such sensitive medical information.

The Ontario privacy commissioner considered whether the hospital had taken reasonable steps to protect the health information, which must include the implementation of administrative and technical measures or safeguards — including policies, procedures, practices, audits, training and awareness programmes.

She also undertook a thorough review, if not audit, of all the hospital’s privacy compliance infrastructure.

Because the hospital in that case had responded diligently when those breaches arose, had taken disciplinary measures against the perpetrators, had increased its staff training on those issues, and had otherwise diligently complied with the security and other measures required by Ontario’s health information protection statute, the Ontario privacy commissioner was “… satisfied that the hospital has adequately addressed the privacy concerns raised by the three breaches … a [conduct] review [of the hospital] is not warranted”.

Although Bermuda and Ontario have different health information privacy laws, they are very similar in their treatment of personal medical information. Certainly, such employee snooping would likely be a violation of Pipa’s medical information privacy protections.

The decisions of the Ontario privacy commissioner are in no way binding in Bermuda, but the case may be instructive about how important preparatory compliance measures can be.

Whether sensitive medical information is in the hands of your healthcare providers, a hospital or your insurance company, the preparatory quality of the organisation’s compliance infrastructure and the diligent nature of its responses to a breach incident may well influence and inform a determination as to whether an organisation has contributed to, or even enabled, such breaches to occur.

First Published In The Royal Gazette, Legally Speaking, May 2023

Twitter LinkedIn Email Save as PDF
More Publications
22 Sep 2023

Reinsurance Strategies in a Hard Market

The extent to which improved market conditions for reinsurers will endure and the importance of main...

22 Sep 2023

Bermuda’s Catastrophe Bond Market Is Enjoying A Record Year

Bermuda’s catastrophe bond market is enjoying a record year, but Bermuda Managing Partner Brad Add...

7 Sep 2023

Bermuda Captives: Reps and Warranties Coverage

The Bermuda captive market is seeing increasing interest in representations and warranty coverage.

16 Aug 2023

In The Spotlight: Bermuda’s Vanessa Schrum

Francesca Ffiske of Private Client Global Elite sat down with Vanessa Schrum from Appleby in Bermuda...

27 Jul 2023

Tech Innovation Financing Alternative

Creators of technology, whether financial services software, biotechnology, data analytics solutions...

12 Jul 2023

Thought Leaders – Commercial Litigation 2023 Q&A

Read John's Q&A with Who's Who Legal.

6 Jul 2023

Employers, employees and PIPA

Now that a date has been set for the coming into force of the Personal Information Protection Act 20...

3 Jul 2023

Pricing Still Not Where It Needs To Be

In spite of climate impacts and some large insurers pulling out of certain markets, there’s been s...

29 Jun 2023

Bermuda’s Pragmatic Regulations

Increasingly, onshore and offshore jurisdictions alike seek to ensure that international business is...