In November of last year, the Sun Country Health Region, before it became the Saskatchewan Health Authority reported a privacy breach in the area. An employee had viewed information on eight hundred and eighty homecare patients through an electronic database called Procura going back to June of 2010.
Sun Country became suspicious on April 4th of 2017 and reported a possible breach to the privacy commissioner on May 29th, 2017. The employee was questioned by Sun Country as well as the home care manager at the time of the breach and a previous manager.
An audit was conducted which uncovered which patients the employee had accessed and what information. The audit also revealed that the employee had continued to make inappropriate accesses after two meetings about the breach, on April 10, 2017, and May 11, 2017.
According to a report from Ron Kruzeniski, Information and Privacy Commissioner, he asserts that Sun Country acted appropriately in dealing with the breach.
A number of recommendations came out of that report including setting up a procedure where its privacy officer is alerted to potential breaches of privacy as soon as they are suspected and continuing implementing the preventive measures that have been identified throughout the whole organization.
He also recommended that the employee be terminated and the that the SHA send the investigation file to the Ministry of Justice, to determine whether or not charges should be laid.
Sun Country has notified the 614 patients who had been affected. The remaining 266 were deceased.