Whether you are an insurance company, hospital or patient, a medical information privacy case in Canada last month illustrates how important is the quality of an organisation’s compliance infrastructure and its response to any breach of such sensitive personal information.

In the Ontario case, a hospital reported to the privacy commissioner three separate medical information privacy breaches under that province’s version of Bermuda’s Personal Information Protection Act 2016. Each involved unauthorised access to a patient’s personal medical information by employees of the hospital who had, in the words of the privacy commissioner, “snooped” those records for non-work-related purposes.

The number of such distinct wrongful access incidents suffered by the hospital aroused the privacy commissioner’s concern that such surreptitious snooping might be systemic across the hospital’s staff so she agreed to hear the complaint against the hospital.

By comparison, under Pipa, all such medical information is defined as sensitive personal information which must be used only for the consented purposes for which it was collected by the retaining organisation.

It must be securely kept to a standard of “safeguard” from unauthorised access that must take into account the likelihood and severity of the harm threatened by any such unauthorised access or misuse, the sensitivity of such personal information and the context in which it is held.

A possible contextual consideration for any hospital is the reasonable patient expectation of confidentiality for such sensitive medical information.

The Ontario privacy commissioner considered whether the hospital had taken reasonable steps to protect the health information, which must include the implementation of administrative and technical measures or safeguards — including policies, procedures, practices, audits, training and awareness programmes.

She also undertook a thorough review, if not audit, of all the hospital’s privacy compliance infrastructure.

Because the hospital in that case had responded diligently when those breaches arose, had taken disciplinary measures against the perpetrators, had increased its staff training on those issues, and had otherwise diligently complied with the security and other measures required by Ontario’s health information protection statute, the Ontario privacy commissioner was “… satisfied that the hospital has adequately addressed the privacy concerns raised by the three breaches … a [conduct] review [of the hospital] is not warranted”.

Although Bermuda and Ontario have different health information privacy laws, they are very similar in their treatment of personal medical information. Certainly, such employee snooping would likely be a violation of Pipa’s medical information privacy protections.

The decisions of the Ontario privacy commissioner are in no way binding in Bermuda, but the case may be instructive about how important preparatory compliance measures can be.

Whether sensitive medical information is in the hands of your healthcare providers, a hospital or your insurance company, the preparatory quality of the organisation’s compliance infrastructure and the diligent nature of its responses to a breach incident may well influence and inform a determination as to whether an organisation has contributed to, or even enabled, such breaches to occur.

First Published In The Royal Gazette, Legally Speaking, May 2023

Share
Twitter LinkedIn Email Save as PDF
More Publications
25 Mar 2024

PIPA Compliance is Not Just a Domestic Affair

As organizations in Bermuda prepare for the full application of the Personal Information Protection ...

25 Mar 2024

How Bermuda trusts can help with worldwide estate planning

Trusts still have an important role to play in onshore tax planning, as acknowledged by the British ...

14 Mar 2024

Privacy Rights Extend Outside Bermuda

As Bermuda prepares for the full application of the Personal Information Protection Act 2016 on Janu...

14 Mar 2024

Bermuda trusts can offer substantial inheritance tax advantages to non-doms following UK budget announcement

The UK government has recently announced radical changes to the way in which non-domiciled individua...

21 Feb 2024

Bermuda Privacy Law Compliance: Pitfalls to Avoid

Although members of the Chamber are aware that Bermuda’s Personal Information Protection Act, 2016...

19 Feb 2024

Bermuda: An Introduction to Dispute Resolution in 2024

International business is the primary area of economic activity in Bermuda, as a result of not just ...

15 Feb 2024

Preserving wealth in a Bermuda dynastic trust

The Vanderbilt family gained prominence through shipping and railroad empires and eventually various...

8 Feb 2024

Bermuda’s promising telecommunications future

Last year was a stellar one for Bermuda’s positioning in the global array of telecommunications se...

25 Jan 2024

Fund Finance Laws and Regulations 2024 – Bermuda

The Bermuda fund industry sees investment predominantly from North America and Europe, and therefore...

24 Jan 2024

Chambers Insurance & Reinsurance Guide 2024: Bermuda

This guide provides the latest information on sources of insurance and reinsurance law, overseas-bas...