[BreachExchange] Pair of St. John's lawyers file class-action lawsuit against Central Health over privacy breach

[Destry Winant]

https://www.journalpioneer.com/news/canada/lawyers-file-class-action-lawsuit-against-central-health-over-privacy-breach-557536/

ST. JOHN'S, N.L. — Two St. John’s lawyers have filed a class-action
lawsuit against the Central Regional Health Authority, seeking damages
for consequences suffered by more than 200 patients whose private
information was illegally accessed.

“The plaintiffs in this case suffered distress, humiliation, anger,
upset, mental anguish, shock, fear of identity theft, uncertainty as
to how the private, confidential medical records and personal health
information has been used, and confusion as to why their private,
confidential medical records and personal health information was
accessed,” Bob Buckingham and Eli Baker wrote in a statement of claim
filed with the province’s Supreme Court earlier this month.

The breach of privacy has left the 240 patients feeling vulnerable,
the lawyers wrote, especially given the time span of the privacy
breach, the number of times their files were accessed and the fact
that in many cases the access was focused on their newborn babies.

“They are alarmed and terrified at the motivation, purpose and intent
of the defendant’s employee’s systematic, targeted intrusion into the
private, confidential medical records and personal health of their
newborn children,” the statement of claim reads.

Last July, Central Health said someone outside the health authority
had alerted them about two weeks previously that an employee had
shared a patient’s private information. An internal investigation
revealed the employee had unlawfully accessed the records of 240
patients online between October 2018 and June 2020.

The health authority said it immediately undertook an investigation
and implemented extra steps to prevent further privacy breaches.

“We take confidentiality and privacy very seriously and sincerely
regret this happened,” said Andree Robichaud, president and CEO of
Central Health.

The employee was no longer working for the health authority, she said.

The lawsuit claims Central Health was negligent in 10 capacities.
Among them: failing to have procedures in place that would have
prevented the privacy breaches, failing to properly train its
employees, failing to conduct adequate reviews to catch illegal access
to files, failing to restrict employees’ access to files so that only
immediately required information was available and failing to take
reasonable steps to protect patients’ private information from
unauthorized access or disclosure.

The statement of claim was filed under the Class Actions Act on Feb. 9.

Central Health did not provide comment when contacted Friday by The Telegram.

Buckingham stated in a news release he hopes to move the case along
through discussions with the health authority’s lawyers and
communication with the court for the assignment of a case management
judge.