The lawyer who’s hoping to certify a class action lawsuit over health records snooping says his client’s case reveals systemic privacy failings in Ontario.

In some ways, the client’s situation is unique — as the alleged snoop is her sister.

“What had happened is the snooping sister was telling friends and relatives of my client all sorts of personal health information about my client that the friends and family couldn’t possibly have known,” lawyer Christopher Du Vernet told QP Briefing.

His client, Mississauga resident Katie Mallinson, approached Trillium Health Partners when word of what her sister, Lisa Lyons, had been saying got back to her.

She told Trillium she believed Lyons must have checked into her health records while working as an administrative assistant for ophthalmologist Tony Vettese.

Trillium Health Partners investigated and confirmed the breach, according to a letter to Mallinson that Du Vernet provided to QP Briefing. The letter says the employee of Vettese (whom it doesn’t name) accessed Mallinson’s records on Trillium’s network on 40 separate occasions over four-and-a-half years. The allegations have not been proved in court.

Vettese has admitting privileges with Credit Valley Hospital in the Trillium Health Partners network and works as investigating coroner for the provincial government; he is also a lecturer at the University of Toronto. Lyons worked at his private practice.

While Trillium Health Partners found five patients’ records had been improperly accessed, Mallinson and Du Vernet believe there were more and are attempting to certify a class action lawsuit against Trillium, Vettese and Lyons, on their behalf.

The statement of claim alleges snooping in health records was Lyons’ “principle pastime” when she had free time at work.

“She did so for her own titillation, entertainment, and amusement; to give her fodder for malicious gossip with friends and family; to satisfy a desire to obtain and sense of control, power, or superiority over the plaintiff and other class members by knowing things about them without them being aware of it; and to elevate her status amongst her acquaintances,” the statement of claim alleges. “It was voyeurism at its worst.”

It has no kind words for Vettese and alleges he took no measures to prevent the snooping. “Motivated by avarice and a sense of omnipotence, he resolved to spend neither money nor time on protecting the privacy of Trillium’s patients,” it claims. “He diverted resources that should have been spent on privacy training and technology to luxury cars, expensive vacations, luxury accommodation for himself, and other indulgences.”

The suit seeks $2 million, half of which is punitive, and argues that Trillium hadn’t taken sufficient measures to protect the health records on its network.

“The hospital had given Lyons the ability to access records of any patient Trillium has ever had for any reason,” Du Vernet alleged in the interview. “I don’t know why someone who’s a secretary to an ophthalmologist is given such broad access.”

He alleges that, even though the hospital doesn’t employ Lyons, it had allowed her access to all of its records regardless — and that it’s not an isolated problem.

“In our view, this illustrates that the present legislation, the present penalties, the present regime is just not adequate,” Du Vernet said. “Stronger penalties, stronger control mechanisms have to be embedded in the legislation because it’s clear that big hospitals like Trillium, that could afford to do it, aren’t doing it absent of that kind of incentive.”

Trillium had relied on an audit system and Du Vernet alleges that, since it had not caught Lyons in four-and-a-half years of snooping, it is not good enough. “The big question this case raises is, how was this woman able to get away with it for so long?” he said.

Trillium released a statement on the issue, saying it’s making improvements.

“We are currently implementing security auditing software that flags any suspicious activity within the system helping to detect breaches in real time,” the hospital’s statement says.

“We perform weekly random audits on individuals with access to the system, which total over 1000 per year – more than most hospitals in the province – and investigate any abnormal activity. We also investigate inappropriate access in response to individual complaints. We follow leading practices in the protection of our patient privacy but always look for opportunities to strengthen protection of personal health information."

Health Minister Eric Hoskins released a statement to QP Briefing emphasizing that the government recently passed legislation strengthening the Health Information and Privacy Protection Act and continues to work with the Information and Privacy Commissioner on the issue.

“Patients deserve to know that their most sensitive information is not being accessed inappropriately and that their privacy is being protected,” the statement says. “We look forward to collaborating with our partners in healthcare to enhance the security of patient information.

“We remain committed to building on Ontario’s position as a leader in health information and privacy protection and will continue to give our health care system the necessary tools to protect the private health information of patients in Ontario.”

Health record privacy problems go beyond one snooping sister, lawyer contends

Read this for free.