Medical faxes go to wrong number

A cluster of faxes with personal medical information sent to the wrong number in Saskatoon is a symptom of a systemic problem in the health system, says the province’s information and privacy commissioner.

Gary Dickson said he is particularly disappointed that after the mistake was pointed out to a number of health providers, many failed to fix it promptly.

"I was underwhelmed with the response," he said in an interview Monday. "Even after the breach had been brought to their attention, we think that the organizations didn’t do an appropriate investigation internally and didn’t implement changes to minimize the chance this would happen again."

Dickson said his office was alerted in April 2009 that a private business was receiving health information — such as health history, referrals, laboratory and other medical exam reports and prescription authorization requests — by fax. A total of 60 faxes was sent by 31 health providers, including nine pharmacies, 11 physicians’ offices, eight regional health authorities and three other health organizations in the province.

The business had only recently acquired the new fax number, and Dickson found the number had previously been assigned to a medical clinic in Saskatoon. It had been out of service for about 17 months before being reassigned.

When Dickson’s office was first contacted about the issue, its first priority was to prevent the transmission of any future faxes. It sent a notice about the incorrect fax number to all health regions and regulatory bodies asking them to notify their members about the issue.

Unfortunately, the business continued to receive faxes during the following weeks, Dickson said. "And we were actually astonished to think that for 17 months (while the fax number was not in service), what happened to the information that would have otherwise been sent?"

According to SaskTel, Dickson said, the parties trying to send the faxes would have received error messages that the fax did not go through.

When asked whether the misdirected faxes had any effect on patient care — for example, if a fax with critical information never reached its proper destination — Dickson said he didn’t know.

"We had our hands full trying to get responses from the 31 trustees," he said.

Dickson’s office opened up investigation files on the trustees who had incorrectly faxed the information.

It also investigated the clinic whose fax number had changed to see if it had taken appropriate steps to notify other health providers in the first place. It found the clinic could have "reasonably done more," although it had made a series of efforts to communicate its new contact information.

The report ultimately found the 31 health providers that sent faxes to the wrong number were responsible for privacy breaches. However, the report notes the issue reaches further than just those organizations, which were scattered across the province.

For example, when the business that was wrongly receiving the faxes got them, it did the right thing by phoning the recipients when they could be identified — not all included cover sheets, which was another problem — to notify them.

"The reaction they reported is that they were often told, ‘It’s no big deal. This happens all the time, just get rid of the paper, destroy it, shred it, whatever,’ " Dickson said.

He also expressed concern about the implication this systemic problem has for the development of electronic health records, which are in the process of being implemented in the province.

"Faxing is not a particularly complex technology. It’s been with us for a long time," Dickson said. "If we’re paying so little attention to faxing properly, what does that suggest when we’re moving to electronic health records, which are much more sophisticated systems with all kinds of risks that result from the same thing — lack of training, lack of policies and procedures."

Saskatchewan Party Health Minister Don McMorris said the problem of the wayward faxes was "very disconcerting" and "totally inappropriate."

"Anytime that there’s a breach of privacy laws and policies and regulations it is a concern. This has just been brought to my attention and I’ve just talked to my deputy minister to see what we can do to make sure that this is corrected as soon as possible," he told reporters at the legislature.

The report recommends the establishment or strengthening of written policies and procedures and training on faxing personal health information for all health organizations.

"We wrote the report with the view to sound a bit of an alarm for health trustees on the things that need to be done to meet the statutory requirements," Dickson said.

Numerous comments made to the information and privacy commissioner’s office during the investigation were "discouraging," said Dickson.

"I am also concerned with the preoccupation of providers with convenience that has eclipsed the need to respect the privacy of patients," he wrote in the report.

One health region wrote to his office that due to the high volume of daily faxes, "it would be unmanageable to require that staff check for confirmation each and every time they send a fax."

And a doctor’s office said dealing with patients’ health issues left "little or no time to implement written policies."

None of the health offices involved in the investigation were identified in the report.