When an aide to the provincial transport minister deleted politically compromising emails, then lied to the privacy commissioner about his actions, serious consequences followed.
George Gretes lost his job, his name was made public and he was fined $2,500 after pleading guilty in court. Gretes faced these penalties because our privacy legislation makes it an offence to wilfully mislead the commissioner.
Even then, Gretes was fortunate. He could have been fined twice that amount, and indeed the special prosecutor in charge of his case recommended the stiffer penalty. The judge settled on a more lenient approach because she thought Gretes had shown remorse.
Now let鈥檚 turn to a different category of wrongdoing that our privacy legislation is strangely silent about. On three separate occasions over the past two years, employees at Island Health rummaged through patient files they had no right to see.
It鈥檚 believed more than 300 patients had their privacy invaded in these acts of voyeurism. Some were family members or neighbours. Others were described as prominent citizens.
At the Vancouver Coastal Health Authority, a worker snooped on the files of media personalities.
Yet none of this was illegal. Nothing in the statute makes it an offence for a staff member to gain unauthorized access to confidential patient files. The act is silent on such serious wrongdoing.
As a result, although the employees were fired for professional misconduct, no fines were levied. Indeed, bizarrely, the privacy rules protected them.
Since they had broken no law, the statute required that their identities be concealed, because naming them would be an invasion of their privacy. As a result, there was nothing to prevent them moving to another job and picking up where they left off. Future employers would have no idea what they had done, unless they voluntarily disclosed it.
The problem doesn鈥檛 lie with Island Health. The authority had no option but to withhold the culprits鈥� identities. (The CEO has tightened security and issued stern warnings to staff.)
But the outgoing privacy commissioner, Elizabeth Denham, noted this flaw last fall when she addressed a legislative committee reviewing her act. She recommended a new clause be added, making the unauthorized viewing of patient files illegal.
The committee agreed with Denham and recommended that such a change be made. The committee went further, and proposed a maximum fine of $25,000. While those recommendations are still subject to cabinet approval, the Health Ministry is prepared to consider acting on them.
This is surely advice the government should accept. Electronic patient records are the technology of the future.
Here on Vancouver Island, attention has focused recently on the difficulties in Nanaimo, where an automated record system is being piloted at the city鈥檚 hospital. Physicians say they find the software slow, hard to work with and frustrating. A review has been ordered by the Health Ministry.
However, sooner or later, this will become a province-wide, and eventually a countrywide, reality. And when that day comes, the opportunities for employee snooping will expand enormously. Yes, enhanced security measures will help. But in themselves, they will not suffice. Sooner or later, someone always finds a loophole.
And evidently the risk of being fired is not a reliable deterrent, as the repeat incidents at Island Health, and elsewhere, show.
The threat of a $25,000 fine, however, along with a very public outing, is another matter.
Our government owes us this protection. Once our medical files are fed into a computerized leviathan, any personal control we might have retained will disappear with them.
If snooping is made a serious offence, it will send a message that behaviour of this sort will not be tolerated 鈥� indeed, that it can be career-ending, as it should.
