Patient Records in Humboldt Broncos Fatal Crash Accessed Inappropriately

2019, Breaches, February

Who: The Saskatchewan Health Authority Medical Clinics

How Many Records: 29

Date: February 12, 2019

What Happened: After Fatal Crash Athletes Electronic Health Records Accessed

How did it happen: Sixteen people were killed and 13 were injured in the crash between the junior hockey team’s bus and a semi trailer at a rural Saskatchewan intersection on April 6, 2018. eHealth Saskatchewan began monitoring the profiles of the patients — which included lab results, medication information and chronic diseases — three days after the crash. From April 9, 2018, to May 15, 2018, the health agency detected at least seven users, mostly doctors, accessed the system to view the profiles of up to 10 patients.

Outcome: The Saskatchewan Health Authority said it is also following up on the breaches and apologized to the patients and their families. The employee’s access to eHealth was suspended and she was given further training, but she has since resigned. A doctor at a Humboldt clinic who viewed the records of two people who were patients prior to the crash. It was determined that the doctor “did not have a need-to-know.” Kruzeniski made a number of recommendations to eHealth —including that it conduct regular monthly audits for the next three years of the physicians involved.The privacy commissioner also recommended that the organization comply with a need-to-know principle rather than a circle-of-care concept and that users of eHealth be made to regularly review their training.