Health Information Breaches Result in Conviction of Clinic Employee

October 3, 2019

A medical office assistant pleaded guilty in Edmonton Provincial Court to knowingly accessing health information in contravention of the Health Information Act (HIA) on September 26, 2019.

Glenda Garcia accessed the health records of two Albertans without a valid purpose under HIA on numerous occasions. She received a $3,500 fine, plus a victim fine surcharge of $525. The unauthorized accesses occurred at the Terwillegar Family Clinic where she was formerly employed.

The two individuals affected by the breaches of health information requested access to their audit logs in Alberta Netcare, the provincial electronic health record system, after Ms. Garcia made suspicious statements to the two individuals about personal medical details. After receiving their audit logs, the individuals submitted complaints to the Office of the Information and Privacy Commissioner (OIPC).

Upon receiving the complaints, the OIPC opened an offence investigation and referred its findings to the Specialized Prosecutions Branch of Alberta Justice. Charges were laid in March 2019.

It is an offence under HIA to knowingly gain or attempt to gain access to health information in contravention of the Act (section 107(2)(b)).

This was the third conviction against an individual for knowingly accessing health information in contravention of HIA in 2019. There have been 12 convictions in total for unauthorized access to health information under HIA since 2001.

This case marked only the second time in which a victim fine surcharge was issued against the convicted. A victim fine surcharge helps fund victim services, such as counseling.