Privacy breach shocks mom

Clerk fired; six-year-old Nevaeh Denine among Eastern Health patients whose information was accessed

Published on March 11, 2016

With her daughter undergoing chemotherapy treatments for cancer, it’s understandable that Holly Denine’s heart jumps up in her throat every time her phone rings and a 777 number appears.

Thursday morning, it happened — but it wasn’t bad news about the health of six-year-old Nevaeh. Eastern Health managers were calling to let Holly know Nevaeh’s medical information was involved in a privacy breach.

Eastern Health confirmed in a media release Thursday afternoon that a clerk based in St. John’s has been fired for inappropriately accessing the health information of 25 patients. The person accessed the files over a period of several months, and was discovered in late February during a random audit conducted within the person’s department.

Eastern Health has identified the patients whose information was accessed, and is in the process of contacting them.

“On behalf of Eastern Health, I want to publicly apologize to the patients whose privacy has been breached,” Debbie Molloy, vice-president responsible for privacy, stated in the release. “In addition to taking appropriate disciplinary action towards employees who wilfully breach our policies, we believe it’s important to publicly disclose and discuss these privacy breaches to reinforce awareness among all health-care workers of their obligation to maintain the privacy of our patients, residents and clients.”

Nevaeh is well-known in the media: diagnosed with a rare form of cancer at age four, she established a successful lemonade stand to raise money for other families dealing with pediatric cancer. In two years, her venture has raised more than $62,000.

Nevaeh is currently being treated once again, and at the time her medical files were accessed late last month, she was an in-patient at the Janeway receiving chemo.

“I know Nevaeh is out in the public with her lemonade stand and all that, but I have never once portrayed her as a victim,” Holly told The Telegram. “It’s always been positive, thumbs up, look how well she is doing. To think someone would invade her privacy like that upsets me. I’m really in shock. I don’t know what the person was hoping to achieve.”

Holly said what bothers her the most is whoever went through Nevaeh’s private information likely knows things her own family members don’t necessarily know.

“I don’t even let the doctors speak to me unless I’m alone,” Holly said. “There are things I don’t always share with all our family because I don’t want to worry them.”

Eastern Health has not given Holly the name of the person it terminated.

“Was this someone I know? Was it a stranger? I don’t know which is worse,” Holly said. “Not that knowing the name really changes anything.”

Eastern Health president and CEO David Diamond said the health authority has a zero-tolerance policy for deliberate breaches of patient privacy.

“It is very disturbing when these breaches occur, given Eastern Health’s clearly stated and reinforced position on wilful breaches,” he said. “However, we assure the people we serve that we assign top priority to our responsibility as a custodian of personal health information.”

Eastern Health has contacted the office of the province’s information and privacy commissioner. The commissioner is responsible for investigating breaches of the Personal Health Information Act.

“Eastern Health immediately informed the Office of the Privacy Commissioner about the breach,” according to a statement from the authority. “The office has the discretion to pursue any further action they feel necessary, including engaging police and/or the department of justice.”

In the fall of 2014, former nurse Colleen (Weeks) Stamp was found guilty of inappropriately accessing patient health records 18 times while working as a triage nurse at the Health Sciences Centre. Stamp, having been fired by Eastern Health, was fined $1,000.

Eastern Health has a number of policies and initiatives in place to help prevent privacy breaches. Employees take an oath of confidentiality, receive regular notices reminding them of their responsiblity to protect patient privacy and participate in an annual Privacy Awareness Week, for example.

Holly said she doesn’t blame Eastern Health for the breach and is satisfied with the actions taken by the health authority.

“They did everything right,” she said.

Nevaeh is home from hospital now, but due to start her next round of chemotherapy March 21. Holly said her health already seems as if it’s improving, and she’s still as positive as ever.

Nevaeh’s cancer is called neuroblastoma, a rare type of cancer seen in infants and young children. According to the Canadian Cancer Society, it starts in immature nerve cells in the sympathetic nervous system. In the past, Nevaeh has had treatment both at the Janeway and at Toronto’s Sick Kids hospital, including chemo, radiation, immunotherapy and a stem cell procedure.

It was Nevaeh’s own idea to hold a lemonade stand in order to help families of other children with cancer. The inaugural lemonade stand — a full-on event — happened in the parking lot of St. Kevin’s Junior High School in Goulds, with music, food, face painting and animals. More than $40,000 was raised that year, and about $22,000 the following year, despite the fact the event was moved inside due to rain. A third annual lemonade stand is planned for this summer.