College of Nurses of Ontario v. Mandy Gayle Edgerton (formerly Reid), 2016 ONCNO 102075 — College of Nurses of Ontario Discipline Committee | minicounsel

PANEL: TAMMY HEDGE, RPN Chairperson GRACE FOX, NP Member LINA KISKUNAS, RN Member MARY MACMILLAN-GILKINSON Public Member DEVINDER WALIA Public Member

BETWEEN:

COLLEGE OF NURSES OF ONTARIO MEGAN SHORTREED for College of Nurses of Ontario

and -

MANDY GAYLE EDGERTON (formerly Reid) Registration No. 0215129 ROBERT STEPHENSON for Mandy Gayle Edgerton (formerly Reid)

JOHANNA BRADEN Independent Legal Counsel

Heard: April 27, 2016

DECISION AND REASONS

This matter came on for hearing before a panel of the Discipline Committee on April 27, 2016 at the College of Nurses of Ontario (“the College”) at Toronto.

Publication Ban

Further to the decision of this Panel dated January 8, 2016, there is a ban on any disclosure outside the hearing room, including a ban on the publication or broadcasting, of the following information.

The names of any clients;
Personal details about any of the clients that could reasonably lead to or contribute to the identification of clients;
The client numbers used to identify clients in the Facility’s computer system;
Personal health information that is sufficiently unique that could reasonably lead to or contribute to the identification of clients;
Information related to the specific personal circumstances of clients who have been identified in media reports about the matter;
Information related to the specific personal circumstances of clients who are identified by their initials in the Amended Notice of Hearing; and
Information about the details of the clients’ visits, such as the date and time of the visits that could reasonably lead to or contribute to their identification.

The panel was made aware of requests for the exhibits in this matter. The panel reviewed the exhibits filed in light of the ruling restricting public disclosure. The panel made certain redactions to exhibit 3. The panel determined no redactions were necessary on any other exhibit. Members of the public may access the exhibits by contacting the Communications Department at the College.

The Allegations

The allegations against Mandy Gayle Edgerton (formerly Reid) (the “Member”) as stated in the Notice of Hearing dated April 23, 2016, are set out below.

At the outset of the hearing, Counsel for the College advised the panel that the College was not calling any evidence with respect to) the allegations set out in paragraphs 1 (b), 2, 3 (b), 4 (a), 4(b), 5 and 6 (a), 6(b) of the Notice of Hearing.

IT IS ALLEGED THAT:

You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(1) of Ontario Regulation 799/93, in that you contravened a standard of practice of the profession or failed to meet the standard of practice of the profession with respect to the following incidents:

(a) while employed as a Registered Nurse at [the Facility],

(i) you accessed personal health information regarding approximately 300 patients, without consent or other authorization, in or about January 2010-March 2012; and

(ii) you accessed personal health information regarding [Client A], without consent or other authorization, on or about August 16, 2011;

(b) while employed as a Registered Nurse at [the Facility] and also as a clinical instructor at [a school], you accessed personal health information regarding one of the nursing students, [ ], without consent or other authorization, and/or you disclosed confidential information about her, without consent or other authorization, to other nursing students [ ].

You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(10) of Ontario Regulation 799/93, in that, while employed as a Registered Nurse at [the Facility] and as a clinical instructor at [a school], you gave information about a client of the [Facility] to a person other than the client or his or her authorized representative except with the consent of the client or his or her authorized representative or as required or allowed by law, when you accessed personal health information regarding one of the nursing students, [ ], and you disclosed confidential information about her, without consent or other authorization, to other nursing students [ ].
You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(37) of Ontario Regulation 799/93, in that you engaged in conduct or performed an act, relevant to the practice of nursing, that, having regard to all the circumstances, would reasonably be regarded by members of the profession as disgraceful, dishonourable or unprofessional with respect to the following incidents:

(a) while employed as a Registered Nurse at the [Facility],

(i) you accessed personal health information regarding approximately 300 patients, without consent or other authorization, in or about January 2010-March 2012; and

(ii) you accessed personal health information regarding [Client A], without consent or other authorization, on or about August 16, 2011;

You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(1) of Ontario Regulation 799/93, in that, while employed as a Registered Nurse at [the Agency] in [ ], Ontario, you contravened a standard of practice of the profession or failed to meet the standard of practice of the profession with respect to the following incidents:

(a) failing to transcribe accurately in the MAR the directions for use for [a medication] for [Client B], [ ], and/or failing to consult with the prescribing physician before modifying the directions for use;

(b) failing to make appropriate inquiries regarding the use of [a medication] for pain relief after concerns were raised by [Client B], and his family, [ ]; and/or

(c) failing to maintain appropriate professional-client boundaries with [Client B], and his family in relation to discussing personal issues such as your divorce and other litigation, bringing personal friends to the home of the client, inviting your father for dinner at the home of the client, purchasing shirts for the client, and/or travelling with the family of the client for a charity event in [ ].

You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(13) of Ontario Regulation 799/93, in that, while employed as a Registered Nurse at [the Agency] in [ ] Ontario, you failed to keep records as required with respect to failing to transcribe accurately in the MAR the directions for use for [ ] for [Client B], [ ], and/or failing to consult with the prescribing physician before modifying the directions for use.
You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(37) of Ontario Regulation 799/93, in that, while employed as a Registered Nurse at [the Agency] in [ ] Ontario, you engaged in conduct or performed an act, relevant to the practice of nursing, that, having regard to all the circumstances, would reasonably be regarded by members of the profession as disgraceful, dishonourable or unprofessional with respect to the following incidents:

(b) failing to make appropriate inquiries regarding the use of [a medication] for pain relief after concerns were raised by [Client B], and his family [ ]; and/or

Member’s Plea

The Member admitted the allegations set out in paragraphs numbered 1(a)(i), 1(a)(ii), 3(a)(i), 3(a)(ii), 4(c) and 6(c) in the Notice of Hearing. For allegation 3(a), the Member admitted that her conduct would be considered by members to be dishonourable and unprofessional. For allegation 6(c), the Member admitted that her conduct would be considered by members to be unprofessional.

The panel received a written plea inquiry which was signed by the Member. The panel also conducted an oral plea inquiry and was satisfied that the Member’s admission was voluntary, informed and unequivocal.

Agreed Statement of Facts

Counsel for the College advised the panel that agreement had been reached on the facts and introduced an Agreed Statement of Facts which provided as follows (note that paragraph 32 has been redacted in light of the Panel’s ban on public disclosure).

THE MEMBER

Mandy Gayle Edgerton (formerly Reid) (the “Member”) obtained a diploma in nursing [ ] in 2002.
The Member registered with the College of Nurses of Ontario (the “College”) as a Registered Nurse (“RN”) in August 2002. There was a lapse in the Member’s registration between April 2003 and May 2004. She also resigned from the College in November 2006, but became an active RN in the General Class again in October 2008.
The Member was employed at [the Facility] between July 2009 and March 2012, when her employment was terminated as a result of the incidents that occurred while she was employed at the Facility, as described below.
Between January 2010 and March 2012, the Member was also employed as a Clinical Instructor in the nursing program at [a school].
The Member was employed at [the Agency] between March 2012 and October 2013, when her employment was terminated as a result of the incidents that occurred at the Agency, as described below.

THE FACILITY

The Facility is located in [ ] Ontario.
At the material times, the Member worked on the Mental Health Crisis Response Unit within the Emergency Department (“MHCRU”) as a full-time staff nurse working day, night and weekend shifts.

Maintenance of Medical Records

Between 2010 and 2012, certain health records were in electronic format, while other records remained in paper format. Among other things, electronic records included transcribed notes and reports, certain client records that were scanned into the system, as well as lab results.
Management at the Facility controlled staff access to the electronic records. A staff member’s access to electronic records was limited depending on the position of that staff member and the access required to fulfil his or her position at the Facility. Nursing staff had access to the health records and admission information for the clients on their unit only. There was an exception for nurses who worked in the Emergency Department, who were given access to client health records for all units in the Facility.
Between January 2010 and March 2012, the Member had access to the health records of all of the clients in the Facility because she worked in the Emergency Department. She did not have to physically be in the Emergency Department to access such records.
At the time of these events, to access the electronic records system, each staff member, including the Member, had a unique username and self-selected confidential password. The Member could log into her account and access health records from any computer terminal in the Facility.
At the time of these events, each time a staff member logged into the electronic records system, a notice would pop up setting out the Facility’s zero tolerance policy regarding “password violation, breach of confidentiality, inappropriate file access, or failure to comply with computer safeguard guidelines and practices”.

Facility Policies on Accessing Client Records

Staff members were required to sign a confidentiality agreement when they received access to the electronic records system.
The Member signed the confidentiality agreement twice in 2009. The confidentiality agreement indicated the following:

I shall ensure that confidential information is not inappropriately accessed, displayed, used or released either directly by me or by virtue of my signature or security access to premises or systems by use of my photo identification.

Violations of this policy include, but are not limited to

accessing information that I do not require for job purposes
misusing, disclosing without proper authorization, or altering patient or personnel information
disclosing to another person my user name and/or password for accessing electronic records.

The Facility also had a Privacy & Confidentiality/Breach of Privacy policy which originally came into effect in September 1999, and had been updated on several occasions since then. It limited access to information on a “need to know” basis. It stated that a breach of confidentiality includes accessing patient information “without the authorization to do so (ie. not required for the performance of one’s duties)”.
The Member completed the Facility’s education program and e-learning module on Privacy on March 5, 2011.

[THE SCHOOL]

[The School] is a college located in [ ] Ontario.
The nursing program at [the School] included clinical placements each semester. The Member worked as a Clinical Instructor at [the School] for placements at the Facility. The Member and her students were assigned to [the Unit], a long-term care unit at the Facility. Therefore, the Member was sometimes in the Facility on [the Unit] when working for [the School], and other times in the MHCRU when working for the Facility.

THE AGENCY

The Agency is a home and community care organization offering homecare, personal support and community services. It serves [ ] communities across Canada.
The Member was employed as a part-time staff nurse [ ].

INCIDENTS RELEVANT TO ALLEGATIONS OF PROFESSIONAL MISCONDUCT

Inappropriate Access of Health Records at the Facility

In or around the beginning of March 2012, one of the Member’s students from [the School] reported to the Facility that she believed that the Member had accessed the student’s electronic health record when she attended at the Emergency Department of the Facility [ ].
As a result of this complaint, the Facility conducted an audit of the Member’s access to electronic health records.
This first audit was completed on March 8, 2012, for the time period between January 14, 2012 and March 8, 2012. When the audit results were reviewed, the Facility was concerned that the Member had accessed client health records inappropriately.
As a result, a second, expanded audit was conducted for the time period between January 2010 and March 2012, which was the length of time that the Member was working in the MHCRU. During this time, the Member had access to the electronic health records for all clients at the Facility.
The Facility removed all accesses from the audit for which the Member might have had some legitimate reason to access a client’s health record, including all clients who were in the Member’s unit at the time of the access. The Member’s manager was consulted when this audit was performed to eliminate all potentially legitimate accesses.
This audit revealed that the Member accessed 285 client records without consent or other authorization. The duration of these accesses ranged from 5 to 869 seconds.
These accesses included health records of clients in the ICU, paediatrics, surgical, palliative and other units of the [Facility] unrelated to the Member’s work in MHCRU or [the Unit]. The accesses also included health records for clients who were dead or not in the hospital at the time the Member accessed the record.
The types of records the Member accessed included visit histories, transcribed reports, scanned documents, diagnostic images, recent clinical results, laboratory data, admissions demographic data (which included addresses and dates of birth), pathology reports, and departmental reports.
The Facility did not carry out regular audits prior to March 2012 and thus, the Member’s accesses were not discovered prior to this time.
If the Member were to testify she would state that she has no specific recollection of all 285 instances set out in the audit report. She would further state that it was her practice to access records in the following circumstances:

(a) The Member states that it was not uncommon for her to be called to see clients in the adjoining emergency department (E.D.). Those clients often would not be admitted to or recorded as a MHCRU client. E.D. clients often presented with a variety of medical and clinical issues, including mental health concerns. After being assessed by an E.D. physician and/or specialist, E.D. clients could be discharged or transferred to different units in the [Facility], such as ICU, surgical, paediatrics, etc. The Member says she would access the records of such clients in an effort to remain current on their clinical status, to plan for the potential return of the client to the MHCRU, to provide follow up report at the shift change, and for other related reasons. However, in cases where the Member was called to consult for an E.D. client, she acknowledges that she should have documented her consultation in the clinical record.

(b) The Member taught [the School] students. As part of her teaching duties, it was the responsibility of the Member to assign clients to her students. The Member states that assignments were not restricted to Unit [ ] clients, but rather, covered the entire spectrum of clinical histories.

(c) The Member suggests that the police and other services would contact the Facility in order to advise staff in the MHCRU that they were bringing in clients. As part of preparing for the arrival of such clients, the Member states that she accessed their files in order to understand their medical and/or mental health histories. She also states that the police and other services might not arrive with clients for a number of reasons, such as the individual stabilized or elected to seek other community services.

(d) The Member states that she also worked as a float in various units, including the Interim Long Term Care (“ILTC”) and palliative units, and she taught on the palliative unit between January and April 2010.

While these practices may explain some of the accesses set out in the audit, and the Member cannot say which accesses her practises account for, she now acknowledges that she had no professional reason to access the bulk of the 285 client records recorded in the audit, and that she did so without consent or other authorization.

Inappropriate Access of a Health Record of [Client A]

[Client A] had known the Member for over 20 years. [ ].
[Client A] had been a client of [ ] the Facility on several occasions for various reasons.
The Member had not been involved in [Client A’s] care at any time.
On August 16, 2011, the Member accessed [Client A’s] electronic health record for 114 seconds. [Client A] was not at the Facility when the Member accessed her record and had not been a client there for [ ] months.
The Member accessed [Client A’s] Visit Record History which included the dates, locations, attending doctors, and principal diagnosis or visit reason for each of her visits to the Facility [ ]. The Member also accessed [Client A]’s transcribed reports, which included a detailed discharge summary, several operative notes, progress reports and test results.
With respect to [Client A], if the Member were to testify, she would state that she recalls the police or other services calling and advising that they were bringing [Client A] to [the Facility]. However, there is no record of any such call, [Client A] denies that she used emergency services at all in [ ], and indeed, [Client A] was not brought to the Facility on the date the Member accessed her record.
The Member now acknowledges that there was no professional purpose for the Member to have accessed [Client A]’s electronic health record.

Notification to Clients of Inappropriate Accesses

The Facility notified the majority of the clients identified in the audit that their personal health information had been accessed inappropriately.
Approximately 10% of those clients called and/or came into the Facility. They were shown the electronic records that were accessed, based on the audit results. Some of the clients were upset.
The Member is one of seven defendants in a class action suit brought against her and others by some of the clients who were notified by the Facility that their health records had been accessed. The Member invokes the protection in s. 14 of the Statutory Powers Procedure Act, s. 9 of the Ontario Evidence Act and s. 5 of the Canada Evidence Act. Furthermore, she does not waive her protection in s. 36(3) of the Regulated Health Professions Act, 1991.

Breach of the Therapeutic Nurse-Client Relationship at the Agency

[Client B] suffered from [ ].
The Member was assigned to provide homecare to [Client B] [ ]. The Member would visit [Client B’s] home around four times per week, including weekends.
During the time that the Member provided care to [Client B], she discussed her personal life with [Client B] and his family, including his wife [ ].
The Member agreed to work the [ ] weekend in 2013, but asked the family if she could bring her father over [ ], indicating that he had nowhere to go. Her father did appear at the house for [ ] dinner.
Around the summer of 2013, the Member went shopping at [ ] a mall [ ], and she returned to [Client B’s] home with shirts that she purchased for him. If the Member were to testify, she would say that the family had requested that she purchase shirts and reimbursed the Member for those purchases.
the Member attended at [Client B’s] house with one or more friends to pick up her car keys from [Client B’s] personal assistant.
The Member invited the family to sign up for a charity event [ ]. The Member was going [ ] with [Client B’s] daughters as part of the [ ] team. The Member’s father drove [Client B] and his wife [ ] and they stayed in the same hotel.
If the Member were to testify she would state that she was trying to assist the family and honouring their requests for various services. At the time, she did not think she was breaching any boundaries. However, she now realizes that she should not have engaged with the client and his family on a personal level, and that in doing so, she failed to maintain the boundaries of the therapeutic nurse-client relationship.

COLLEGE STANDARDS

Confidentiality and Privacy – Personal Health Information

The College published a Practice Standard in 2004 titled, Confidentiality and Privacy – Personal Health Information, which was later updated in 2009. It discusses the expectations and obligations of a nurse under the Personal Health Information Protection Act (“PHIPA”).
The Practice Standard begins with a general statement about the purpose of practice standards:

Nursing standards are expectations that contribute to public protection. They inform nurses of their accountabilities and the public of what to expect of nurses. Standards apply to all nurses regardless of their role, job description or area of practice.

The Practice Standard continues:

… PHIPA permits the sharing of personal health information among health care team members to facilitate efficient and effective care. The health care team includes all those providing care to the client…

Personal health information is any identifying information about clients that is in verbal, written or electronic form.

A nurse is responsible for ensuring that she/he uses client information only for the purpose(s) for which it was collected. A nurse should ensure that it remains secure within the healthcare team. …

…Sharing information among members of the healthcare team to provide care is one use of information under PHIPA...

The Practice Standard contains the following statement of the standard of practice about personal health information:

Nurses share relevant information with the healthcare team, whose members are obliged to maintain confidentiality. Nurses must explain to clients that information will be shared with the healthcare team and identify the general composition of the healthcare team.

The Practice Standard provides key indicators nurses can use to ensure they are meeting the standard, including:

The nurse meets the standard by:

seeking information about issues of privacy and confidentiality of personal health information;
maintaining confidentiality of clients’ personal health information with members of the healthcare team, who are also required to maintain confidentiality, including information that is documented or stored electronically;
maintaining confidentiality after the professional relationship has ended, an obligation that continues indefinitely when the nurse is no longer caring for a client or after a client’s death;
ensuring clients or substitute decision-makers are aware of the general composition of the health care team that has access to confidential information;
collecting only information that is needed to provide care;
not discussing client information with colleagues or the client in public places such as elevators, cafeterias and hallways;
accessing information for her/his clients only and not accessing information for which there is no professional purpose;
safeguarding the security of computerized, printed or electronically displayed or stored information against theft, loss, unauthorized access or use, disclosure, copying, modification or disposal;
not sharing computer passwords; …

Therapeutic Nurse-Client Relationship, Revised 2006

The College published a Practice Standard in 1999 titled, Therapeutic Nurse-Client Relationship, Revised 2006, which has been updated on several occasions, the most recent substantive update being in June 2009.
The Practice Standard begins by stating that therapeutic nursing services “contribute to the client’s health and well-being” and the relationship is based on “trust, respect, empathy and professional intimacy, and requires appropriate use of the power inherent in the care provider’s role.”
The Practice Standard defines “Boundary” as the following:

A boundary in the nurse-client relationship is at the point at which the relationship changes from professional and therapeutic to unprofessional and personal. Crossing a boundary means that the care provider is misusing the power in the relationship to meet her/his personal needs, rather than the needs of the client, or behaving in an unprofessional manner with the client. The misuse of power does not have to be intentional to be considered a boundary crossing.

The Practice Standard sets out four standard statements with accompanying indicators that describe a nurse’s accountabilities in the nurse-client relationship.
The Practice Standard indicates that nurses must maintain boundaries as they “are responsible for effectively establishing and maintaining the limits or boundaries in the therapeutic nurse-client relationship.” The key indicators include the following.

A nurse meets the standard by:

setting and maintaining the appropriate boundaries within the relationship, and helping clients understand when their requests are beyond the limits of the therapeutic relationship;
ensuring that any approach or activity that could be perceived as a boundary crossing is included in the care plan developed by the health care team …;
recognizing that there may be an increased need for vigilance in maintaining professionalism and boundaries in certain practice settings (for example, when care is provided in a client’s home, a nurse may become involved in the family’s private life and needs to recognize when her/his behaviour is crossing the boundaries of the nurse-client relationship);
ensuring that she/he does not interfere with the client’s personal relationships;
abstaining from disclosing personal information, unless it meets an articulated therapeutic need of the client (for example, disclosing a personal problem may make the client feel as if his/her problems/feelings are being diminished or that the client needs to help the nurse);
continually clarifying her/his role in the therapeutic relationship, especially in situations in which the client may become unclear about the boundaries and limits of the relationship (for example, when an identified part of a nurse’s role includes accompanying a client to a funeral to provide care);
abstaining from engaging in financial transactions unrelated to the provision of care and services with the client or the client’s family/significant other;
consulting with colleagues and/or the manager in any situation in which it is unclear whether a behaviour may cross a boundary of the therapeutic relationship, especially in circumstances that include self-disclosure or giving a gift to or accepting a gift from a client;
ensuring that the nurse-client relationship and nursing strategies are developed for the purpose of promoting the health and well-being of the client and not to meet the needs of the nurse, especially when considering self-disclosure, giving a gift to or accepting a gift from a client; ...

The Practice Standard also sets out the circumstances in which a gift may be given to a client. A gift may only be given from a group of nurses or from an agency/corporation after determining that:

the client is clear that the nurse does not expect a gift in return;
it does not change the dynamics of the therapeutic relationship; and
there is no potential for negative feelings on the part of other clients or toward other members of the health care team.

Nurses are also required to protect clients from harm or abuse by ensuring that abuse is prevented or stopped and reported. The nurse meets this standard by “not entering into a friendship, or a romantic, sexual or other personal relationship with a client when a therapeutic relationship exists” and “not engaging in activities that could result in monetary, personal or other material benefit, gain or profit for the nurse (other than the appropriate remuneration of nursing care or services), the nurse’s family and/or the nurse’s friends, or result in monetary or personal loss for the client”.

ADMISSIONS OF PROFESSIONAL MISCONDUCT

The Member admits that her accesses to the personal health information of clients not under her care and/or not at the Facility between January 2010 and March 2012 as described in paragraphs 21 to 41 above, were without consent, authorization or other professional purpose and constituted a breach of the College’s Practice Standard, Confidentiality and Privacy – Personal Health Information. The Member also admits that this conduct would be regarded by members of the profession as unprofessional and dishonourable.
The Member admits that she failed to maintain the appropriate professional-client boundaries with client [Client B] and his family when she discussed personal issues with them, brought personal friends to their home, invited her father over for dinner, purchased shirts for [Client B] and travelled with [Client B] for a charity event [ ]. The Member acknowledges that the College Practice Standard, Therapeutic Nurse Client Relationship, Revised 2006, was in place at the time of these incidents and reflects the standards expected of a nurse. She admits that she breached this standard when she engaged in the conduct described above in paragraphs 42 to 49. She further admits that this conduct would be regarded by members of the profession as unprofessional.
In particular, the Member admits that she committed the acts of professional misconduct as alleged in the following paragraphs of the Notice of Hearing:

paragraph 1(a)(i) and (ii), in that she contravened a standard of practice of the profession or failed to meet the standards of practice of the profession when she accessed the personal health information for approximately 285 clients without consent or other authorization, between January 2010 and March 2012, and accessed the personal health information of [Client A] without consent or other authorization on August 16, 2011;
paragraph 3(a)(i) and (ii), in that she accessed the personal health information for approximately 285 clients without consent or other authorization between January 2010 and March 2012, and accessed [Client A’s] personal health information without consent or other authorization on August 16, 2011, which would reasonably be regarded by members of the profession as unprofessional and dishonourable;
paragraph 4(c), in that she contravened a standard of practice of the profession or failed to meet the standards of practice of the profession when she failed to maintain appropriate professional-client boundaries with [Client B] and his family [ ]; and
paragraph 6(c), in that she failed to maintain appropriate professional-client boundaries with [Client B] and his family [ ], which would reasonably be regarded by members of the profession as unprofessional.

The College leads no evidence with respect to allegations 1(b), 2, 3(b), 4(a) and (b), 5 or 6(a) and (b) of the Notice of Hearing.

Decision

The panel considered the Agreed Statement of Facts and finds that the facts support a finding of professional misconduct and, in particular, finds that the Member committed an act of professional misconduct as alleged in paragraphs 1(a)(i) and 1(a)(ii) of the Notice of Hearing in that she contravened the Standards of Practice when she accessed the files of approximately 300 clients without authorization to do so. The panel finds this conduct to be dishonourable and unprofessional, and therefore makes a finding of professional misconduct as alleged in paragraph 3(a)(i) and 3(a)(ii) of the Notice of Hearing.

The panel finds the facts also support a finding of professional misconduct in that the Member also contravened the Standards of Practice by failing to maintain appropriate boundaries with a client as alleged in paragraph 4(c). The panel finds this conduct to be unprofessional as alleged in paragraph 6(c).

As to allegations 1(b), 2, 3(b), 4(a) and (b), 5, and 6(a) and (b), College Counsel advised that she was not calling any evidence in respect of them. Accordingly, the panel dismisses allegations 1(b), 2, 3(b), 4(a) and (b), 5, and 6(a) and (b) in the Notice of Hearing.

Reasons for Decision

The panel found that the facts set out in the Agreed Statement of Facts support the allegations as set out in the amended Notice of Hearing.

Allegations 1(a)(i) and 3(a)(i) in the Notice of Hearing are supported by paragraphs 21 through 31and 62 in the Agreed Statement of Facts.

Allegations 1(a)(ii) and 3(a)(ii) in the Notice of Hearing are supported by paragraphs 32 through 38, 62 and 64 in the Agreed Statement of Facts

Allegations 4(c) and 6(c) in the Notice of Hearing are supported by paragraphs 42 through 49, 63 and 64 in the Agreed Statement of Facts.

Penalty

Counsel for the College advised the panel that a Joint Submission as to Order had been agreed upon. The Joint Submission as to Order requests that this panel make an order as follows:

Requiring the Member to appear before the Panel to be reprimanded within three months of the date that this Order becomes final.
Directing the Executive Director to suspend the Member’s certificate of registration for four months. This suspension shall take effect from the date that this Order becomes final and shall continue to run without interruption as long as the Member remains in the practising class.
Directing the Executive Director to impose the following terms, conditions and limitations on the Member’s certificate of registration:

a) The Member will attend three meetings with a Nursing Expert (the “Expert”), at her own expense and within nine months from the date this Order becomes final. To comply, the Member is required to ensure that:

i. The Expert has expertise in nursing regulation and has been approved by the Director of Professional Conduct (the “Director”) in advance of the meetings;

ii. At least seven days before the first meeting, the Member provides the Expert with a copy of:

the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
if available, a copy of the Panel’s Decision and Reasons;

iii. Before the first meeting, the Member reviews the following College publications and completes the associated Reflective Questionnaires, online learning modules and online participation forms (where applicable):

Professional Standards,
Ethics,
Therapeutic Nurse Client Relationship, and
Confidentiality and Privacy – Personal Health Information;

iv. Before the first meeting, the Member reviews Circle of Care: Sharing Personal Health Information for Health-Care Purposes, as released by the Information and Privacy Commissioner of Ontario;

v. At least seven days before the first meeting, the Member provides the Expert with a copy of the completed Reflective Questionnaires, and online participation forms;

vi. The subject of the sessions with the Expert will include:

the acts or omissions for which the Member was found to have committed professional misconduct,
the potential consequences of the misconduct to the Member’s clients, colleagues, profession and self,
strategies for preventing the misconduct from recurring,
the publications, questionnaires and modules set out above, and
the development of a learning plan in collaboration with the Expert;

vii. Within 30 days after the Member has completed the last session, the Member will confirm that the Expert forwards his/her report to the Director, in which the Expert will confirm:

the dates the Member attended the sessions,
that the Expert received the required documents from the Member,
that the Expert reviewed the required documents and subjects with the Member, and
the Expert’s assessment of the Member’s insight into her behaviour;

viii. If the Member does not comply with any one or more of the requirements above, the Expert may cancel any session scheduled, even if that results in the Member breaching a term, condition or limitation on her certificate of registration;

b) For a period of 18 months from the date the Member returns to the practice of nursing, the Member will notify her employers of the decision. To comply, the Member is required to:

i. Ensure that the Director is notified of the name, address, and telephone number of all employer(s) within 14 days of commencing or resuming employment in any nursing position;

ii. Provide her employer(s) with a copy of:

the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
a copy of the Panel’s Decision and Reasons, once available;

iii. Ensure that within 14 days of the commencement or resumption of the Member’s employment in any nursing position, the employer(s) forward(s) a report to the Director, in which it will confirm:

that they received a copy of the required documents,
that they agree to notify the Director immediately upon receipt of any information that the Member has breached the standards of practice of the profession, and
that they agree to notify the Director immediately upon determining, whether through an audit of the Member’s electronic health record accesses or otherwise, that the Member has accessed client health records without consent or other authorization; and
All documents delivered by the Member to the College, the Expert or the employer(s) will be delivered by verifiable method, the proof of which the Member will retain.

Penalty Submissions

Submissions were made by College Counsel and the Member’s Counsel. The parties agreed that

the mitigating factors in this case were:

The Member has no prior discipline history; and
The Member admitted to the misconduct and cooperated with the College.

The parties agreed that the aggravating factors in this case were:

The misconduct occurred over a period of 3 years at two different settings;
A significant number of records were accessed (approximately 285);
The misconduct occurred in the face of the Member’s knowledge of the College’s Standards of Practice and the Facility’s policy and training related to privacy;
The misconduct was not inadvertent but done with knowledge and intent;
There was access without professional purpose to [Client A’s] record, when the individual was not a client of the hospital;
There were boundary violations related to [Client B]; and
Two misconduct spanned two different categories of violation: privacy breaches and boundary breaches.

The parties submitted that the proposed penalty provides for specific deterrence through the oral reprimand, the 4 month suspension, and the 18 month period of employer notification.

The proposed penalty of 4 months is appropriate as it meets the needs of specific and general deterrence and is within a reasonable range for the conduct. It sends a clear message to members of the profession that unauthorized access to clients’ personal health information will not be tolerated.

The proposed penalty provides for remediation and rehabilitation through the terms, conditions and limitations specifically meetings with a nursing expert. The public is protected as the Member will attend meetings with the nursing expert to reflect on the College’s standards and PHIPA legislation, and her employer will be aware of the panel’s findings and monitoring will be expected.

Counsel submitted cases to demonstrate that the proposed penalty fell within the range of similar cases as follows:

CNO v. Oliveira (Discipline Committee, 2015). This case involved multiple unauthorized access of up to 1300 client records. A suspension of 5 months was ordered, with similar terms and conditions.
CNO v. Calvano (Discipline Committee, 2015). This case was closer in facts as there was unauthorized access to 300 records. It identified the mounting public concern regarding this type of misconduct. The penalty ordered was similar to the one proposed in the present case with respect to terms, conditions and limitations. A 3 month suspension was ordered.
CNO v. Heydens (Discipline Committee, 2011). This case was presented in the context of a breach of the Therapeutic Nurse Client Relationship Standard. The client was a home care client where a personal relationship developed. A 2 month suspension was ordered in this case.

The Member’s Counsel made submissions that the Panel should comment on the Facility’s lack of regular electronic medical record audits. He suggested the Facility bore responsibility for the Member’s misconduct, in that it failed to identify unwarranted activity early. He submitted that if the Facility had been more attentive, it would have decreased the number of unauthorized accesses to personal health information and provided the Member with guidance about meeting her professional obligations.

Penalty Decision

The panel accepts the Joint Submission as to Order and accordingly orders as follows.

The Member shall appear before the Panel to be reprimanded within three months of the date that this Order becomes final.
The Executive Director is directed to suspend the Member’s certificate of registration for four months. This suspension shall take effect from the date that this Order becomes final and shall continue to run without interruption as long as the Member remains in the practising class.
The Executive Director is directed to impose the following terms, conditions and limitations on the Member’s certificate of registration:

(a) The Member will attend three meetings with a Nursing Expert (the “Expert”), at her own expense and within nine months from the date this Order becomes final. To comply, the Member is required to ensure that:

i. The Expert has expertise in nursing regulation and has been approved by the Director of Professional Conduct (the “Director”) in advance of the meetings;

ii. At least seven days before the first meeting, the Member provides the Expert with a copy of:

the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
if available, a copy of the Panel’s Decision and Reasons;

Professional Standards,
Ethics,
Therapeutic Nurse Client Relationship, and
Confidentiality and Privacy – Personal Health Information;

iv. Before the first meeting, the Member reviews Circle of Care: Sharing Personal Health Information for Health-Care Purposes, as released by the Information and Privacy Commissioner of Ontario;

v. At least seven days before the first meeting, the Member provides the Expert with a copy of the completed Reflective Questionnaires, and online participation forms;

vi. The subject of the sessions with the Expert will include:

the acts or omissions for which the Member was found to have committed professional misconduct,
the potential consequences of the misconduct to the Member’s clients, colleagues, profession and self,
strategies for preventing the misconduct from recurring,
the publications, questionnaires and modules set out above, and
the development of a learning plan in collaboration with the Expert;

vii. Within 30 days after the Member has completed the last session, the Member will confirm that the Expert forwards his/her report to the Director, in which the Expert will confirm:

the dates the Member attended the sessions,
that the Expert received the required documents from the Member,
that the Expert reviewed the required documents and subjects with the Member, and
the Expert’s assessment of the Member’s insight into her behaviour;

(b) For a period of 18 months from the date the Member returns to the practice of nursing, the Member will notify her employers of the decision. To comply, the Member is required to:

i. Ensure that the Director is notified of the name, address, and telephone number of all employer(s) within 14 days of commencing or resuming employment in any nursing position;

ii. Provide her employer(s) with a copy of:

the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
a copy of the Panel’s Decision and Reasons, once available;

iii. Ensure that within 14 days of the commencement or resumption of the Member’s employment in any nursing position, the employer(s) forward(s) a report to the Director, in which it will confirm:

that they received a copy of the required documents,
that they agree to notify the Director immediately upon receipt of any information that the Member has breached the standards of practice of the profession, and
that they agree to notify the Director immediately upon determining, whether through an audit of the Member’s electronic health record accesses or otherwise, that the Member has accessed client health records without consent or other authorization; and
All documents delivered by the Member to the College, the Expert or the employer(s) will be delivered by verifiable method, the proof of which the Member will retain.

Reasons for Penalty Decision

The Panel concluded that the proposed penalty is reasonable and in the public interest and in line with previous cases. The Panel finds that the penalty satisfies the principles of specific and general deterrence, rehabilitation, remediation and public protection. In particular the four month suspension sends a clear message to the membership that breaches of privacy will not be dealt with lightly.

It is the obligation of all nurses to know and understand the Standards of Practice of the profession. It is in meeting these standards that clients are protected and their trust in the profession is maintained. The Member has cooperated with the College and, by agreeing to the facts and a proposed penalty, has accepted responsibility for her actions. The penalty is within the range of what has been ordered in similar cases, accounting for the fact that this case involves breaches of privacy as well a boundary violation.

The Panel declines to make any comments on the Facility’s role in this case. There was no evidentiary foundation for these submissions. Even if the Facility was somehow at fault, the Member’s obligations were independent of the Facility’s obligations.

I, TAMMY HEDGE, RPN, sign this decision and reasons for the decision as Chairperson of this Discipline panel and on behalf of the members of the Discipline panel as listed below:

Chairperson Date

Panel Members:

Grace Fox, NP

Lina Kiskunas, RPN

Mary MacMillan-Gilkinson, Public Member

Devinder Walia, Public Member