After tragedy, Lapu Lapu victims were victims of ‘snooping’ at hospitals: report

In the aftermath of the deadly Lapu Lapu tragedy last April, dozens of people were rushed to hospitals to receive care.

Now, an investigation from B.C. Information and Privacy Commissioner Michael Harvey has found that 71 snooping incidents by 36 health-care workers happened, meaning their medical records were accessed without permission.

“When I say snooping, what I mean is the unauthorized access of a patient file by someone who doesn’t need to have access to it,” Harvey said.

Half of the patients treated after Lapu Lapu had their privacy breached, 16 in total.

The breaches happened across the Fraser Health, Vancouver Coastal Health and the Provincial Health Services Authorities and within Providence Health Care.

“We were obviously quite concerned once we learned about the extent of this, of this snooping, and so I launched an investigation,” Harvey said.

5:07 Remembering the Lapu Lapu tragedy in Vancouver

The report found that most of the access was driven by curiosity and some employees opened multiple files a day.

Get weekly health news

Receive the latest medical news and health information delivered to you every Sunday.

Sign up for weekly health newsletter Sign Up

By providing your email address, you have read and agree to Global News' Terms and Conditions and Privacy Policy.

According to the report, those employees faced discipline ranging from suspensions to terminations and some were reported to their regulatory colleges.

“To misuse that access is the betrayal of trust, and so we need to take this issue very, very seriously,” Harvey said.

Two health authorities initially argued that patients didn’t need to be told their privacy had been breached, but the commissioner disagreed.

“I think the concern was, do we need to harm them again by telling them something that they don’t need to know?” Harvey asked.

“But I think the conversation that we had with the health authorities about what people have a right to know was a very useful conversation to have.”

2:50 Lapu Lapu victim speaks to Global News

On April 26, the day of the tragedy, the report shows that the first breaches occurred.

Within days, audits began, confidential flags were added to files and memos were sent reminding staff about privacy.

By April 30, the first breach was reported to the commissioner’s office.

“It is a tremendous violation of a person’s privacy,” Harvey said.

“Health information, health records, are confidential and must remain that way. There is no excuse for this behaviour.”

The commissioner found safeguards were in place, but were not strong enough.

The report made nine recommendations, including clearer privacy training, real-time monitoring and discipline strong enough to deter snooping.

In a joint statement, the health authorities called these breaches “unacceptable” and “inexcusable” and said collectively they have accepted all recommendations in the report.

“This — this kind of activity, this kind of action — really violates that trust,” B.C. Health Minister Josie Osbourne said.

“It’s important for us to rebuild it. That’s why I take the report so seriously.”

The commissioner says that intentional snooping is not a chronic issue, but in an era of digital records and high-profile tragedies, protecting patient privacy is more critical than ever.