Find a registrant or pharmacy

Find a registrant Find a pharmacy

Search the website

Help me with...

Health information must only be accessed for authorized purposes

October 4, 2023
Lessons Learned: misuse of authority to access health information is unprofessional conduct.

A recent Hearing Tribunal issued its written decision on the merit and orders about the conduct of a pharmacy technician who was found to have accessed multiple patients’ health information without any authorized purpose. The unauthorized accesses, including accessing her own electronic health records, occurred on multiple occasions over an eight-month period. The Hearing Tribunal found that the pharmacy technician misused her authority as a health information custodian. Although there was no information to suggest the pharmacy technician disclosed the health information of the patients, the Hearing Tribunal found that the pharmacy technician’s conduct was unprofessional and warranted sanctions.

The requirement for regulated members to properly collect, use, disclose, and safeguard their patients’ health information is foundational to the relationship between pharmacy professionals and patients. When health information is accessed without an authorized purpose, this relationship is eroded, as is the integrity of the profession.

In this matter, the Tribunal imposed penalties, even though there had been no previous history of unprofessional conduct on the part of the pharmacy technician, there was no disclosure of patient health information, the pharmacy technician fully admitted to her unprofessional conduct, and the pharmacy technician’s employment had been terminated. The Tribunal accepted the pharmacy technician had accessed the health information in good faith to inform her duties as a pharmacy technician and did not know the patients personally, but as she did not have an authorized purpose for accessing the information, the Tribunal ordered the following:

  • a reprimand,
  • an order that the pharmacy technician must disclose the Hearing Tribunal’s written decision to any pharmacy employer for a period of one year, and
  • a payment of $2,000 towards the costs of the investigation and hearing.

Rationale for the Tribunal’s decision, is reflected in its following statements:

  • Pharmacy technicians are part of a self-regulated profession. One of the foundations of a self-regulating profession is that their members are diligent and trustworthy in their practice. It is a fundamental expectation that pharmacy technicians will demonstrate understanding and compliance with their legal and ethical obligations when accessing health information. Breaches of this trust, even if unintentional, have the potential to harm the public, and the reputation of the pharmacy profession.
  • When regulated health professionals breach their legal and ethical obligations by accessing health information without proper authorization, it undermines the public’s confidence in the safeguarding of their health information.

Pharmacy technicians and pharmacists – review your ethical duties to your patients, your profession, and yourself

  1. Ensure that you properly limit your access of health information to only that information which is required to perform your duties. Before you access a patient’s health information, ensure that you and your employer understand your scope of practice, and agree on your roles and responsibilities, and the health information that will be required (and not required) to fulfill these duties.
  2. Review, understand, and comply with all aspects of the collection, use, disclosure, and safeguarding responsibilities of health information. Excellent information about these responsibilities can be found on the ACP website in the Resource section. The publication Helping pharmacists and pharmacy technicians understand the Health Information Act may be particularly informative.
  3. Visit the Office of the Information and Privacy Commissioner (OIPC) of Alberta website. In addition to health information resources, this website also provides summaries of recent OIPC investigations and decisions involving health information.
  4. Discuss the proper use of health information with your peers and your employer.
  5. Review, and update as needed, your pharmacy’s health information policies and procedures.
  6. Review and discuss with peers your fundamental ethical obligations. Principles 1, 4, and 10 of the Code of Ethics will provide you with valuable guidance in this respect.
  7. Review, and discuss with your colleagues, ACP’s tenets of professionalism.