A nefarious intent is not required in order to constitute a breach of client confidentiality. A plastic surgeon faced disciplinary, privacy enforcement and civil consequences for using video and audio surveillance cameras throughout his office, including in examination rooms, without patient consent. Even though the images were not shared with or improperly obtained by others, the conduct was seen as indefensible. An Ontario court ordered the plastic surgeon to pay $22.5 million to the affected patients in a class action lawsuit.
In addition, the plastic surgeon was reprimanded, suspended for six months, and ordered to undergo remediation at a discipline hearing for similar misconduct. The misconduct in the discipline hearing also included posting other images on social media without the consent of the patient or where the consent had been obtained through questionable means given the power imbalance between the practitioner and the patient. The discipline panel was clear that privacy had been breached simply by recording the images of patients without their knowledge or truly informed consent. Lastly, the Ontario Information and Privacy Commissioner also condemned the behaviour.
A recent Australian decision found a physician to have engaged in professional misconduct, and imposed a $30,000 fine, for taking images of patients without their consent and publicly posting images in an “non-identifying” manner. Attempting anonymity was insufficient to justify the privacy breach.
Both regulators and the courts are increasingly conveying the message that cameras and confidentiality do not mix.
This scenario is distinct from the more common instances of registrants’ “snooping” through the records of friends and family members for non-clinical purposes. Earlier this year, an Ontario nurse was suspended for three months for accessing the health care files of four friends.
