A Regina doctor viewed patient records of another physician without an apparent need to do so, according to Saskatchewan’s privacy commissioner.
In an investigation report released on Jan. 8, 2024, Dr. Richardson at Queen City Medical Specialists (QCMS) reported a privacy breach by Dr. Ogundare on July 5, 2023 and requested an investigation from the privacy commissioner.
Saskatchewan’s privacy commissioner took on the investigation after Dr. Richardson provided completed privacy breach documents.
Dr. Richardson, who owns QCMS at 11th Avenue in Regina, explained that Dr. Ogundare is an independent contractor who had rented space in the QCMS clinic at the time.
The privacy commissioner noted that medical charts of four affected patients, including first and last name, date of birth, health services number, address, medical history, diagnosis, medication list, family history, allergies, and lifestyle notes, were viewed.
Dr. Richardson explained that on March 23, 2023, the clinic’s privacy officer/office manager was told that Dr. Ogundare accessed a patient’s medical chart on March 13, 2023. The clinic’s privacy officer then conducted an audit with Accuro, the Electronic Medical Record vendor, revealing that Dr. Ogundare made several other questionable accesses.
- Get the CTV News app for Regina breaking news alerts and top stories
Dr. Richardson said that Dr. Ogundare had no reason to access personal health information, and there was no phone call or other request to do so.
“When the breach was discovered [they] denied then blamed the office manager for “framing him” and gave various insufficient information on his intentions,” the report read.
The snooping occurred after hours, with Dr. Ogundare changing the physician profile to Dr. Richardson to access the patient records. Dr. Ogundare did not report accessing the charts, the report read.
He was encouraged to self-report the breach, which was then referred to the College of Physicians and Surgeons of Saskatchewan (CPSS).
Dr. Richardson provided a complaint letter which was filed with the CPSS to the privacy commissioner’s office, requesting that the CPSS investigate the matter and take disciplinary action.
When the privacy commissioner contacted CPSS to determine if it had conducted its investigations, CPSS said that if it found enough evidence to warrant an investigation, it would form a committee, which could take three to nine months.
Based on all the evidence presented, the privacy commissioner confirmed that a breach occurred.
As of June 1, 2023, Dr. Ogundare’s access at QCMS was cancelled.
Following the incident, the privacy commissioner found that Dr. Richardson and QCMS took appropriate steps to contain the breach.
The privacy commissioner recommended that a schedule of proactive system audits be implemented to identify any unauthorized access or potential privacy breaches. The other recommendation was to include more details in notification letters, such as what possible types of harm may result from the incidents.
