Thursday, March 13, 2014

Violations of Privacy and Just Cause by Greg

Before his retirement, former Saskatchewan Information and Privacy Commissioner Dickson noted on several occasions that arbitral jurisprudence in Saskatchewan had limited the discipline which could be meted out to employees for breaches of privacy. See e.g. Regina Qu’Appelle Regional Health Authority (Re), 2013 CanLII 5640 (SK IPC) at para. 71, and 2012-2013 Annual Report (PDF) at p. 23.

Shortly after his retirement, a new arbitration decision has addressed exactly that point - and confirmed that repeated breaches of privacy may give rise to just cause for termination even on the part of an employee with an otherwise distinguished employment record.

In Health Sciences Association of Saskatchewan v Saskatchewan Association of Health Organizations, 2014 CanLII 5231 (SK LA) (Hood) ("HSAS"), the grievor was a 25-year employee of the Prairie North Health Region (the "Health Region") who had previously served as a supervisor/manager for approximately 10 years before returning to a position as a staff therapist.

In 2012, two incidents of the grievor seeking access to the Picture Archiving & Communication System (“PACS”) for purposes other than patient care came to the attention of the Health Region, resulting in a full audit of her use of PACS. The audit revealed that the grievor had accessed PACS to retrieve the personal health information of 99 different people who were not her patients, including "past and present co-workers, supervisors, senior management of the Employer, members of the immediate and extended family of the Grievor and well-known, prominent community members" (para. 57).

After meeting with the grievor seeking her response to the audit, the employer terminated her employment. The union argued that termination was excessive discipline for an acknowledged breach of policy, and that part of the problem arose out of a lack of awareness as to what policies actually governed employee access to personal health information.

Arbitrator Hood (for the majority of the arbitration panel) distinguished previous Saskatchewan cases which involved only a small number of violations of privacy. He concluded as follows at para. 244-245, 263-264:

This was not something the Grievor did on the spur of the moment, reacting to some momentary aberration that would dissipate with the passage of time. This was part of a plan to access at will the personal health information of those who were not her patients. PACS was the tool that allowed the Grievor to perpetrate the improper access. PACS is province-wide. In PACS the medical images are electronic and stored digitally. The digital information can be accessed on PACS by anyone with a password, anytime, from anywhere and by multiple persons at the same time from different locations. Gone are the days when the medical images were recorded on film and archived in file rooms. In those days the images could only be viewed where the film was physically located and only by those present at the time.

The temptation to access anyone on PACS proved too great for the Grievor to resist. The Employer’s Confidentiality Policies, the Codes of Conduct of the two governing professional bodies that licensed the Grievor, and HIPA were not enough to suppress this temptation.

...

Discharge is a heavy penalty and even more so when the person is a long-term employee with a clean disciplinary record.  Discharge is the capital punishment for employee misconduct in collective bargaining agreements. However, in our view, discharge in these circumstances is just and reasonable.

PACS makes it easier to access confidential medical records surreptitiously. No one is standing over your shoulder or, for that matter, there to see if what you are doing is proper.  It is improper to take advantage of this ease of access and succumb to any temptation to snoop into personal health information.

Accordingly, the majority of the panel upheld the grievor's termination.

Due to the large number of wilful breaches of privacy found by the arbitration panel, it is not clear that HSAS represents a substantial change in course from Saskatchewan's previous arbitral jurisprudence.

However, it does offer the first Saskatchewan example of a fact scenario which does cross the line from conduct which can be corrected, to disregard for privacy which goes to the core of an employment relationship. And the recognition that even an otherwise-admired worker may be terminated for failing to respect privacy law and policy may offer a signal as to the importance of patient privacy for employers and employees alike.

This blog consists of general legal information only, and does not constitute the provision of legal advice to any person or organization. Please contact me at gfingas@grj.ca if you require legal advice related to labour, employment or privacy issues.

Leave a comment

Comments