In an old case that was controversial at the time, a medical practitioner acting in the capacity as a journalist published an article about a medical error in a hospital. The article identified the patient. The practitioner was disciplined for breaching the confidentiality of that patient: Re Shulman and College of Physicians & Surgeons of Ontario, 1980 CanLII 1700 (ON SC), https://canlii.ca/t/g1d6d.
An analogous case in the internet age can be found at: Denham v. Ontario College of Social Workers, 2021 ONSC 5149 (CanLII), https://canlii.ca/t/jh43v. The practitioner, a social service worker, was in conflict with a local child services agency in her personal capacity. She surreptitiously recorded a meeting at the agency where confidential non-client information was recorded. The recording was posted on the internet. She also found a gap in the security of the agency’s website that provided access to numerous files containing sensitive client information. She posted the URL to those documents on various internet platforms encouraging people to access the information. She also identified (to the traditional media) where on the agency’s website the privacy failings were located.
The Divisional Court upheld the finding of professional misconduct and the sanction of a suspension of up to six month along with remediation. The Court said:
In sum, the Committee was entitled on all of the facts before it to find that:
-
- the Appellant had demonstrated her disregard for the importance of the rights to privacy and confidentiality of 285 families involved with FCSLLG [the agency] and the potential adverse impact that publication or dissemination of their confidential information could have on them; and
- she should have known better than to act as she had with regard to the confidential information of FCSLLG and the 285 families.
The conduct was unprofessional. The Court also found that the conduct breached provincial legislation despite the practitioner’s acquittal on provincial offences charges. The discipline panel was not bound by that finding given the different standard of proof and the different evidence in the two proceedings. In particular, at the discipline hearing there was evidence of the practitioner encouraging others to access the confidential information left exposed on the agency’s website and that the practitioner did not take steps to notify the agency of the privacy breach so that it could be protected. The Court also accepted that the practitioner’s conduct was a serious breach of her duty to respect client privacy even if the clients were not hers.
The Court also accepted that there was no unfairness in the procedure at the hearing where the practitioner was confined to the agreed statement of facts and where documents referenced in the agreed statement of facts were provided to the hearing panel.
Practitioners have a professional obligation to respond appropriately to a privacy breach by others and not to permit or encourage dissemination of confidential client information.