PHI Faxed to the Same Wrong Number for Years

For years, a used-computer store in Saskatchewan has been receiving patient records over its fax line. The owner has tried to be nice about it, but Darryl Arnold says he’s finally “fed up,” according to area radio station CJME-AM.

Despite repeated conversations with the Saskatchewan Health Authority (SHA), Arnold says, he continues to receive patient documents.  For example, the morning of March 12 he received a five-page medical report.

Over the years “he’s received dozens of private health records and was told an investigation would be conducted earlier this year,” according to Global News.

Except for a single digit, the fax number for his store, Kelly’s Computer Works, is the same as a local physician’s office. So aggravating are the recurring data breaches that “I’ve offered to sell them my fax number, because I really don’t want to deal with this,” says Arnold.

The store is in North Battleford, a city of nearly 14,000. The community is hometown for singer-songwriter Joni Mitchell, and it hosts an agricultural museum and pioneer village. Just across the North Saskatchewan River is the Town of Battleford.

Kelly’s Computer Works was the first used-computer store in either community when it opened in 1995. It includes a service center, but today specializes in the sale of custom-built new, refurbished and used computer systems. Needless to say, their work does not include healthcare informatics – except as an unintended liability for health systems.

SHA officials have released a statement indicating that the agency is aware there have been previous instances of information inadvertently faxed to a wrong number.

“As with any potential privacy breach, we will be reporting this in accordance with privacy policy and procedures, and conducting investigation into what has occurred,” according to SHA. “As part of this process [we] have alerted the Office of the Saskatchewan Information and Privacy Commissioner.”

The health authority has made conflicting comments about the breaches. It’s asked that “anyone who has received a fax in error to notify the senders or a Saskatchewan Health Authority privacy office.” But the agency also assures that “any patient involved in a privacy breach is notified in writing.” So if it notifies patients, why is SHA asking the public for incident reports in the first place?

The health authority states that it expects the investigation will lead to “recommendations on how to ensure this error is not repeated.”

Arnold says he never looks at the patient information. He just wants the problem to be fixed.

Join Moxe Health’s interactive network of 36 million health systems, plans and patients whose records never get lost in Saskatchewan. (photo courtesy of Google Earth)