The Office of the Information and Privacy Commissioner ('OIPC') published, on 10 February 2022, the conclusion of its investigation, as issued on 7 February 2022, in which an unnamed regional court imposed a fine of CAD 5,000 (approx. €3,620) to a former Alberta Health Services ('AHS') employee for violations of Section 107(2)(b) of the Health Information Act ('HIA'), following unauthorised access of health information.

Background to the investigation

In particular, the OIPC outlined that it had initiated an offence investigation into Marie Mushinski, a former AHS employee, after AHS notified the OIPC of a data breach in June 2020, following which charges were laid in April 2021.

Findings of the OIPC

Furthermore, the OIPC detailed that Mushinksi accessed the health information of 189 individuals 985 times during a two-year period and highlighted that none of the individuals were patients at the AHS unit where Mushinksi was employed as a clerk.

Outcomes

Finally, the OIPC noted that Mushkisnki plead guilty on 7 February 2022 to have accessed health information in violation of Section 107(2)(b) of the HIA, and was fined CAD 5,000 (approx. €3,620) and a CAD 1,000 (approx. €725) victim fine surcharge, as well as a 18 months probation period, which includes a ban on employment in any capacity that allows access to health information.

You can read the press release here.