Whether you are an insurance company, hospital or patient, a medical information privacy case in Canada last month illustrates how important is the quality of an organisation’s compliance infrastructure and its response to any breach of such sensitive personal information.

In the Ontario case, a hospital reported to the privacy commissioner three separate medical information privacy breaches under that province’s version of Bermuda’s Personal Information Protection Act 2016. Each involved unauthorised access to a patient’s personal medical information by employees of the hospital who had, in the words of the privacy commissioner, “snooped” those records for non-work-related purposes.

The number of such distinct wrongful access incidents suffered by the hospital aroused the privacy commissioner’s concern that such surreptitious snooping might be systemic across the hospital’s staff so she agreed to hear the complaint against the hospital.

By comparison, under Pipa, all such medical information is defined as sensitive personal information which must be used only for the consented purposes for which it was collected by the retaining organisation.

It must be securely kept to a standard of “safeguard” from unauthorised access that must take into account the likelihood and severity of the harm threatened by any such unauthorised access or misuse, the sensitivity of such personal information and the context in which it is held.

A possible contextual consideration for any hospital is the reasonable patient expectation of confidentiality for such sensitive medical information.

The Ontario privacy commissioner considered whether the hospital had taken reasonable steps to protect the health information, which must include the implementation of administrative and technical measures or safeguards — including policies, procedures, practices, audits, training and awareness programmes.

She also undertook a thorough review, if not audit, of all the hospital’s privacy compliance infrastructure.

Because the hospital in that case had responded diligently when those breaches arose, had taken disciplinary measures against the perpetrators, had increased its staff training on those issues, and had otherwise diligently complied with the security and other measures required by Ontario’s health information protection statute, the Ontario privacy commissioner was “… satisfied that the hospital has adequately addressed the privacy concerns raised by the three breaches … a [conduct] review [of the hospital] is not warranted”.

Although Bermuda and Ontario have different health information privacy laws, they are very similar in their treatment of personal medical information. Certainly, such employee snooping would likely be a violation of Pipa’s medical information privacy protections.

The decisions of the Ontario privacy commissioner are in no way binding in Bermuda, but the case may be instructive about how important preparatory compliance measures can be.

Whether sensitive medical information is in the hands of your healthcare providers, a hospital or your insurance company, the preparatory quality of the organisation’s compliance infrastructure and the diligent nature of its responses to a breach incident may well influence and inform a determination as to whether an organisation has contributed to, or even enabled, such breaches to occur.

First Published In The Royal Gazette, Legally Speaking, May 2023

Twitter LinkedIn Email Save as PDF
More Publications
30 May 2023

Appleby Bermuda Contributes to Private Trust Companies Handbook Second Edition

Vanessa Schrum, Partner and Group Head of Appleby’s Private Client and Trusts department in Bermud...

25 Apr 2023

Singularis Holdings: 10 Years’ Later

In 2013, the Caymanian liquidators of Singularis Holdings Limited (“SHL”) sought information fro...

Contributors: James Batten
24 Apr 2023

Passion for Transaction Motivates Adderley

Appleby Bermuda leader shares his journey to the top and his belief that hard work beats good grades...

24 Apr 2023

The Calculation of Holiday Pay for Employees with Irregular Hours

As we move into the summer months, employers are likely to receive more frequent requests for leave ...

20 Apr 2023

Bermuda leads in tackling climate change

Bermuda's proactive approach to climate change and environmental, social and governance (ESG) initia...

3 Apr 2023

No Surprise If It’s a Record Year for Cat Bonds

The coalescence of more deals, new sponsors, and importantly, new risks, suggests it could be an exp...

23 Mar 2023

Digital Assets in Bermuda – Unpacking the Proportionality Principle

A digital asset business wishing to obtain a licence under the Digital Asset Business Act 2018 will ...

Contributors: Karim Creary
10 Mar 2023

Bermuda Companies with Outsourced Services Should Review Contracts

It could be the influence of the Bermuda Triangle, but the convergence of several different circumst...

27 Feb 2023

Bermuda Businesses: Are You Ready to Comply with Our New Privacy Rules?

There have been recent indications from the Bermuda Government that Bermuda’s Personal Information...

24 Feb 2023

Home Transfers Within a Family Still Incur Taxes in Bermuda

Any home sale or transfer either by a live person or by inheritance typically attracts stamp duty.