New details have emerged in an investigation into a 2023 privacy breach in Thessalon First Nation involving unauthorized access to personal health records.
In an April 24 letter from Maamwesying North Shore Community Health Services, patients were advised that a laptop computer belonging to a nurse was removed from Thessalon First Nation Health Centre on Dec. 18, 2023 and taken to the band office.
The nurse then used her remote access login to its electronic health record to look at “health records for a few patients from Thessalon First Nation” — and then shared medical information with staff members at the band office during a meeting held in the boardroom.
“You were one of those patients,” Maamwesying chief privacy officer Michelle Brisbois said in the letter to patients affected by the breach. “We could not find a clinical reason why the nurse or band office members needed to look at your records.”
Jaime Lanteigne, who is a non-Indigenous resident of Thessalon First Nation, expressed frustration over the health-care provider’s findings.
“It’s bad enough that we knew that she shared it with one person, but the fact that they had a meeting and shared it with multiple people? It just baffles me,” Lanteigne said.
Sources have previously told SooToday that more than 20 patients received letters from Maamwesying in early 2024 informing them of the privacy breach.
The Indigenous-led health-care provider reported the breach to both the College of Nurses of Ontario (CNO) and the Information and Privacy Commissioner of Ontario (IPC), which launched separate investigations into the incident.
Lanteigne received a letter from the CNO earlier this year, advising her that the nurse accused of accessing personal health records will not face any discipline from the college.
“They basically just said that because she was new and she really didn’t know her job, she didn’t know how the system worked,” she said.
“I threw mine out. I was pissed off.”
The IPC declined to divulge any details of its ongoing investigation.
“We intend to issue a public decision of our findings and will follow up with you when it is available,” a spokesperson told SooToday Monday.
Maamwesying pulled all of its health-care workers out of Thessalon First Nation in April 2024 and relocated them to a satellite office in the nearby town of Thessalon, where health-care services are currently being provided to band members.
Thessalon First Nation has yet to take any accountability for its role in the privacy breach, Lanteigne said.
“I think they were just hoping if they ignored it, it would go away,” she added. “But it's totally 100 per cent their fault that Maamwesying pulled itself out of the community.”
Thessalon First Nation Chief Joe Wabigwan told SooToday via email that Maamwesying has not communicated with Thessalon First Nation directly regarding “this alleged privacy breach,” nor has it responded to queries from staff and senior management.
“I would have expected them as our health delivery partner to contact me or my band manager directly,” said Wabigwan.
“They receive federal funding in our name.”
The First Nation retained an independent, third-party workplace investigation firm last year in order to look into the breach.
“Our investigation found no wrongdoing requiring disciplinary action under our employee policies,” said Wabigwan. “Our investigation did find that Maamwesying’s information technology contractor, Telus, issued our staff a user name and password to Maamwesying's electronic health records system without Maamwesying’s knowledge or authorization.”
Wabigwan also denied that a nurse — who was mentioned by name in the initial letter from Maamwesying informing patients of the breach — was involved in the December 2023 incident.
SooToday has chosen not to disclose the name of the nurse until the IPC concludes its investigation into the matter.
“No meeting took place in the band office that day as alleged,” Wabigwan said.
The nurse has also denied that the incident occurred, according to Maamwesying’s recent letter to patients affected by the privacy breach.
Maamwesying did not respond to a request for comment made by SooToday. Its chief privacy officer declined to comment when reached by SooToday on Tuesday.