Being a health information custodian comes with responsibility

A recent Hearing Tribunal issued its written decision on the merit and orders about the conduct of a pharmacist who was found to have accessed a person’s health information without any authorized purpose. The unauthorized access of the person’s Provincial Electronic Health Records (Netcare) occurred on a single occasion. The person was not a patient of the pharmacist and did not have a personal relationship with the pharmacist. The Hearing Tribunal found that the pharmacist misused her authority as a health information custodian and pharmacist. Although there was no information to suggest the pharmacist disclosed the health information of the person, the Hearing Tribunal found that the pharmacist’s conduct was unprofessional and warranted sanctions.

The requirement for registrants to properly collect, use, disclose, and safeguard Albertans’ health information is an essential element in pharmacy professionals being authorized to have access to Netcare. When health information is accessed and used for an unauthorized purpose, it calls into question whether pharmacy professionals can be trusted to have Netcare access, and the integrity of the profession is eroded.

In this matter, the Tribunal imposed significant penalties, even though there had been no previous history of unprofessional conduct on the part of the pharmacist, there was no disclosure of patient health information, and the pharmacist admitted to her unprofessional conduct. The Hearing Tribunal ordered

• A reprimand.
• The successful completion of an ethics course, at her own cost, within one year. Should the pharmacist be unsuccessful in completing the ethics course within the year, her practice permit shall be suspended until she receives an unconditional pass.
• A three-month suspension, with the first month to be served from December 12, 2024, to January 11, 2025, and the remaining two months to be held in abeyance, pending there being no further privacy concerns for a period of two years.
• An order that the pharmacist must disclose the Hearing Tribunal’s written decision to any pharmacy employer or licensee for a period of two years.
• A payment of 25 per cent of the costs of the investigation, totalling approximately $5,900.

Rationale for the Tribunal’s decision, is reflected in its following statements:

• The expectation that pharmacists only access or use health information for authorized purposes is also made clear in Subsections 4(4) and 4(5) of the Code of Ethics, which sets out limits on the information pharmacists may seek and how pharmacists may use information obtained while practicing.

• In addition, [the pharmacist’s]conduct was a violation of sections 25 and 107(2)(a) and (b) of the HIA. Section 25 of the Health Information Act prohibits a custodian of health information, such as [the pharmacist], from using health information except in accordance with the Act. None of the purposes set out in the Health Information Act applied when [the pharmacist’s]accessed [the person’s] health information.

• Finally, [the pharmacist’s]conduct undermined the profession’s integrity, decreased the public’s trust, and demonstrated a lack of judgment because regulated members are granted the privilege of accessing Netcare, which contains a significant amount of personal health information for specific and authorized purposes related to medical services. It is a fundamental expectation that Pharmacists will only access the information when authorized to do so and only use it pursuant to patient care.

Pharmacists and pharmacy technicians – treat health information with the attention required

1. Review, understand, and comply with all aspects of the collection, use, disclosure, and safeguarding responsibilities of health information. Excellent information about these responsibilities can be found on the ACP website in the Guidance and guidelines section. The publication Helping pharmacists and pharmacy technicians understand the Health Information Act may be particularly informative.
2. Visit the Alberta Office of the Information and Privacy Commissioner (OIPC) website. In addition to health information resources, this website also provides summaries of recent OIPC investigations and decisions involving health information.
3. Discuss the proper use of health information with your peers.
4. Understand that Albertans are empowered to access their Netcare access logs, and can identify those custodians that access their health information and can question unfamiliar accesses. 
5. Review, and update as needed, your pharmacy’s health information policies and procedures.
6. Review and discuss with peers your fundamental ethical obligations. Principles 1, 4, and 10 of the Code of Ethics will provide you with valuable guidance in this respect.
7. Review, and discuss with your colleagues, ACP’s tenets of professionalism.