College of Nurses of Ontario v. Ann H.A. Raeburn-Lewis, 2016 ONCNO 104256

DISCIPLINE COMMITTEE OF THE COLLEGE OF NURSES OF ONTARIO

PANEL: ROBERT MACKAY, Chairperson Public Member GRACE FOX, NP Member SHIRAZ IRANI, RN Member MARY MACMILLAN-GILKINSON Public Member HEATHER STEVANKA, RN Member

BETWEEN:

COLLEGE OF NURSES OF ONTARIO MEGAN SHORTREED for College of Nurses of Ontario

• and -

ANN H.A. RAEBURN-LEWIS Registration No. 9043092 LUV M.I. CYRUS for Ann. H.A. Raeburn

JOHANNA BRADEN Independent Legal Counsel

Heard: August 17, 2016

DECISION AND REASONS

This matter came on for hearing before a panel of the Discipline Committee (the “Panel”) on August 17, 2016 at the College of Nurses of Ontario (“the College”) at Toronto.

College Counsel requested a ban on the public disclosure, including publication and broadcasting, of the name of the client and information that would reasonably identify the client. The Member’s representative consented to the order. The panel granted the motion.

The Allegations

The allegations against Ann Raeburn-Lewis (the “Member”) as stated in the Notice of Hearing dated June 10, 2016 are as follows.

IT IS ALLEGED THAT:

1. You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(1) of Ontario Regulation 799/93, in that, while employed as a Registered Nurse through [the Agency], working at [the Hospital] in [ ], Ontario (the “Hospital”), you contravened a standard of practice of the profession or failed to meet the standard of practice of the profession with respect to accessing a Hospital client’s personal health information in electronic medical records, without consent or other authorization, on or about September 13, 2014, at 23:58.

2. You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(37) of Ontario Regulation 799/93, in that, while employed as a Registered Nurse through the Agency, working at the Hospital, you engaged in conduct or performed an act, relevant to the practice of nursing, that, having regard to all the circumstances, would reasonably be regarded by members of the profession as disgraceful, dishonourable or unprofessional with respect to accessing a Hospital client’s personal health information in electronic medical records, without consent or other authorization, on or about September 13, 2014, at 23:58.

As to allegation 2, counsel for the College advised the Panel that the College was only requesting a finding that the Member’s conduct would reasonably be considered by members to be dishonourable and unprofessional.

Member’s Plea

The Member admitted the allegations set out in paragraphs 1 and 2 in the Notice of Hearing. Her admission to allegation 2 was that her conduct would reasonably be regarded by members as dishonourable and unprofessional.

The Panel received a written plea inquiry which was signed by the Member. The Panel also conducted an oral plea inquiry and was satisfied that the Member’s admission was voluntary, informed and unequivocal.

Agreed Statement of Facts

Counsel for the College and the member advised the Panel that agreement had been reached on the facts and introduced an Agreed Statement of Facts, which reads as follows.

AGREED STATEMENT OF FACTS

THE MEMBER

1. Ann H. A. Raeburn-Lewis (the “Member”) obtained a diploma in nursing from George Brown College in 1989.

2. The Member registered with the College of Nurses of Ontario (the “College”) as a Registered Nurse (“RN”) on June 6, 1990.

3. The Member was employed at [the Agency] as a casual agency nurse from October 2013 to September 16, 2014 when her employment was terminated as a result of the incident set out below. The Member worked shifts at [the Hospital] through the Agency.

THE CLIENT

4. [The Client] was [ ] years old at the time of the incident.

5. The Client was on [the Unit] at the Hospital.

6. At the time of the incident, [the Client] was [ ]. Given the Client’s profile, the Hospital took extra measures to protect [ ] privacy.

7. The Hospital used PowerChart as its electronic health record system. When PowerChart is launched, a Privacy Notice appears, which states:

Privacy of our patients and protection of their personal health information is a top priority for [the Hospital]. Access to any aspect of a patient’s record is restricted only to those individuals involved in the circle of care for that patient or other authorized users. [The Hospital] regularly audits access to all health records, and any unauthorized access may lead to disciplinary action up to and including termination of employment…

8. The Client was designated a [ ] client by the Hospital, which meant that a yellow star appeared beside [the Client’s] name when [the Client’s] name or Medical Record Number was entered in PowerChart. When [the Client’s] health record was accessed, by clicking on [the Client’s] name, a Privacy Notice popped up that said:

Please respect the privacy of this patient’s health record. The hospital will be auditing access to this record, and any unauthorized access will be addressed in accordance with [the Hospital’s] privacy policies.

By clicking “ok” I confirm that I am part of the circle of care of this patient, and am accessing this record for the purpose of providing care only.

9. On September 11, 2014, the Hospital President and CEO sent an email hospital-wide with the subject line: [ ]. The email stated:

As you may be aware, a [ ] patient was admitted here at [the Hospital] earlier today. At this time I ask for your full cooperation and diligence in following our clinical and privacy protocols while this patient remains in our care, as we do for all our patients.

10. The Member worked the night shift at the Hospital on September 11, 2014.

HOSPITAL & AGENCY POLICIES

11. Both the Agency and the Hospital had confidentiality policies in place.

12. The Hospital had a policy titled “Confidentiality of Personal Health Information Policy and Procedure.” The purpose of the Policy was to outline the Hospital’s “commitment to the protection of patient health information from theft, loss and unauthorized access, copying, modification, use and disclosure.”

13. The Policy also contained a section called Breaches of Patient Privacy, which stated that a breach “includes any intentional or inadvertent unauthorized access, use or disclosure of confidential information and any inappropriate disposal of confidential information.”

14. The Agency had confidentiality policies, titled “[The Agency] Privacy Policies” and “Health Record Policies.” On October 25, 2013, the Member signed an Agreement, called “Privacy, Confidentiality and Information Security Agreement for Client/Patient, Confidential and Proprietary Information.”

15. In signing the Agreement, the Member agreed to comply with Hospital privacy policies. She also acknowledged compliance with the Agency’s privacy policies, including a statement agreeing to, “access, use and disclose client/patient information only as allowed … and limit it to the minimum amount necessary to perform my authorized duties.”

COLLEGE STANDARDS

16. The College issued a Practice Standard titled Confidentiality and Privacy – Personal Health Information (“Practice Standard”). It was first published in 2004 and updated in 2009. It largely addresses PHIPA.

17. The Practice Standard begins with a general statement about the purpose of practice standards:

Nursing standards are expectations that contribute to public protection. They inform nurses of their accountabilities and the public of what to expect of nurses. Standards apply to all nurses regardless of their role, job description or area of practice.

18. The Practice Standard provides key indicators nurses can use to ensure they are meeting the standard, including:

The nurse meets the standard by:

• seeking information about issues of privacy and confidentiality of personal health information;

• maintaining confidentiality of clients’ personal health information with members of the healthcare team, who are also required to maintain confidentiality, including information that is documented or stored electronically;

• maintaining confidentiality after the professional relationship has ended, an obligation that continues indefinitely when the nurse is no longer caring for a client or after a client’s death;

• ensuring clients or substitute decision-makers are aware of the general composition of the health care team that has access to confidential information;

• collecting only information that is needed to provide care;

• not discussing client information with colleagues or the client in public places such as elevators, cafeterias and hallways;

• accessing information for her/his clients only and not accessing information for which there is no professional purpose;

• safeguarding the security of computerized, printed or electronically displayed or stored information against theft, loss, unauthorized access or use, disclosure, copying, modification or disposal;

• not sharing computer passwords; …

19. The Member acknowledges that she was bound by the College’s Practice Standard and that a nurse who breaches those standards and the statutory obligations set out in PHIPA is subject to discipline by the College.

INCIDENT RELEVANT TO ALLEGATIONS OF PROFESSIONAL MISCONDUCT

20. The Member worked the night shift at [the Hospital] on September 13, 2014.

21. In September 2014, the Hospital conducted an internal audit of its electronic document system. The audit revealed that during the night shift on September 13, 2014 at 23:58, the Member accessed the personal health record of [the Client], a client for whom she had not been providing care. The audit report confirmed the access to the Client’s “Inpatient Summary,” which clearly contains personal health information within the meaning of PHIPA.

22. The Member was working in [Unit 1] on the [ ] floor when she accessed the health record. The Client was in [Unit 2]. There is no connection between these units, and the Member was not in the Client’s circle of care.

23. The Member admitted to the Agency that she accessed the Client’s personal health records without consent or proper authorization out of curiosity, although she stated that she exited the record quickly and without reading anything. The Member expressed regret for breaching the Client’s privacy and acknowledged her actions to both the Agency and the College.

ADMISSIONS OF PROFESSIONAL MISCONDUCT

24. The Member admits that her unauthorized accesses to the Client’s personal health information set out in paragraphs 20 to 23 above constitutes a breach of the College’s standard on Confidentiality and Privacy – Personal Health Information.

25. The Member admits that she committed the acts of professional misconduct as alleged in the following paragraphs of the Notice of Hearing:

• 1, in that she contravened a standard of practice of the profession or failed to meet the standards of practice of the profession ; and

• 2, in that she engaged in conduct or performed an act, relevant to the practice of nursing, that having regard to all the circumstances, would reasonably be regarded by members of the profession as dishonourable and unprofessional.

Decision

The Panel finds that the Member committed acts of professional misconduct as alleged in paragraphs 1 and 2 of the Notice of Hearing.

Reasons for Decision

The Panel considered the Agreed Statement of Facts and the Member’s plea and finds that this evidence supports findings of professional misconduct as alleged in the Notice of Hearing.

Allegation #1 in the Notice of Hearing is supported by paragraphs 21, 22, 23, 24 and 25 in the Agreed Statement of Facts.

Allegation #2 in the Notice of Hearing is supported by paragraphs 23, 24 and 25 in the Agreed Statement of Facts. The Panel finds that the Member’s conduct was a serious breach of her professional obligations. It would also be considered by members as dishonourable. It demonstrated an element of dishonesty and deceit as the Member did not heed the hospital policy, the CEO’s email and privacy notices associated with the client’s file.

Penalty

Counsel for the College and the Member advised the panel that a Joint Submission on Order had been agreed upon. The Joint Submission requests that this panel make an order as follows.

1. Requiring the Member to appear before the Panel to be reprimanded within three months of the date that this Order becomes final.

2. Directing the Executive Director to suspend the Member’s certificate of registration for one month. This suspension shall take effect from the date that this Order becomes final and shall continue to run without interruption as long as the Member remains in the practising class.

3. Directing the Executive Director to impose the following terms, conditions and limitations on the Member’s certificate of registration:

a) The Member will attend two meetings with a Nursing Expert (the “Expert”), at her own expense and within six months from the date that this Order becomes final. To comply, the Member is required to ensure that:

i. The Expert has expertise in nursing regulation and has been approved by the Director of Professional Conduct (the “Director”) in advance of the meetings;

ii. At least seven days before the first meeting, the Member provides the Expert with a copy of:

1. the Panel’s Order,

2. the Notice of Hearing,

3. the Agreed Statement of Facts,

4. this Joint Submission on Order, and

5. if available, a copy of the Panel’s Decision and Reasons;

iii. Before the first meeting, the Member reviews the following College publications and completes the associated Reflective Questionnaires, online learning modules and online participation forms (where applicable):

1. Professional Standards,

2. Confidentiality and Privacy – Personal Health Information,

iv. At least seven days before the first meeting, the Member provides the Expert with a copy of the completed Reflective Questionnaires, online participation forms;

v. Before the first meeting, the Member reviews Circle of Care: Sharing Personal Health Information for Health-Care Purposes, as released by the Information and Privacy Commissioner of Ontario;

vi. The subject of the sessions with the Expert will include:

1. the acts or omissions for which the Member was found to have committed professional misconduct,

2. the potential consequences of the misconduct to the Member’s clients, colleagues, profession and self,

3. strategies for preventing the misconduct from recurring,

4. the publications, questionnaires and modules set out above, and

5. the development of a learning plan in collaboration with the Expert;

vii. Within 30 days after the Member has completed the last session, the Member will confirm that the Expert forwards his/her report to the Director, in which the Expert will confirm:

1. the dates the Member attended the sessions,

2. that the Expert received the required documents from the Member,

3. that the Expert reviewed the required documents and subjects with the Member, and

4. the Expert’s assessment of the Member’s insight into her behaviour;

viii. If the Member does not comply with any one or more of the requirements above, the Expert may cancel any session scheduled, even if that results in the Member breaching a term, condition or limitation on her certificate of registration;

b) For a period of 18 months from the date the Member returns to the practice of nursing, the Member will notify her employers of the decision. To comply, the Member is required to:

i. Ensure that the Director is notified of the name, address, and telephone number of all employer(s) within 14 days of commencing or resuming employment in any nursing position;

ii. Provide her employer(s) with a copy of:

1. the Panel’s Order,

2. the Notice of Hearing,

3. the Agreed Statement of Facts,

4. this Joint Submission on Order, and

5. a copy of the Panel’s Decision and Reasons, once available;

iii. Ensure that within 14 days of the commencement or resumption of the Member’s employment in any nursing position, the employer(s) forward(s) a report to the Director, in which it will confirm:

1. that they received a copy of the required documents, and

2. that they agree to notify the Director immediately upon receipt of any information that the Member has breached the standards of practice of the profession; and

3. All documents delivered by the Member to the College, the Expert or the employer(s) will be delivered by verifiable method, the proof of which the Member will retain.

Penalty Submissions

Submissions were made by College Counsel. The Member’s representative indicated that he agreed with those submissions.

The parties agreed that the mitigating factors in this case were that:

a) this was a first offence;

b) this was a single act;

c) the Member admitted the misconduct to the employer and the College; and

d) the Member expressed remorse

The aggravating factors in this case included that there were numerous warnings regarding access to confidential information. There was:

a) the Agency policy;

b) the Hospital policy;

c) the College’s standards;

d) the provisions of the statute Personal Health Information Protection Act, 2004;

e) two built-in warnings in the computer system; and

f) the specific client file was flagged.

The proposed penalty provides for general deterrence through the suspension given to the Member. College Counsel indicated that general deterrence was a special concern, since unauthorized access to health care records remains a significant issue of public importance.

The proposed penalty provides for specific deterrence, remediation and rehabilitation through the reprimand and terms, conditions and limitations to the Members certificate.

Overall, the parties agreed that the public is protected because the proposed penalty meets the requirements of general deterrence to the membership and specific deterrence to the Member, as well as remediation and rehabilitation of the Member.

College Counsel submitted cases to the Panel to demonstrate that the proposed penalty fell within the range of similar cases from this Discipline Committee. She indicated generally that the range of suspension for cases of unauthorized access was 1-5 months. CNO v. Smith (Discipline Committee, 2008) was presented to illustrate the penalty ordered where there was access involving multiple accesses of information about a single client, plus disclosure of information to other parties. In CNO v. Billsberger (Discipline Committee, 2011) the nurse accessed four client records, leading to a suspension of one month. CNO v. Colvano (Discipline Committee, 2015), CNO v. Oliviera (Discipline Committee, 2015) and CNO v. Reid (Discipline Committee, 2016) were also noted although in those cases the accesses to records were numerous and over a lengthy period of time.

Penalty Decision

The Panel accepts the Joint Submission as to Order and accordingly orders:

1. The Member shall appear before the Panel to be reprimanded within three months of the date that this Order becomes final.

2. The Executive Director is directed to suspend the Member’s certificate of registration for one month. This suspension shall take effect from the date that this Order becomes final and shall continue to run without interruption as long as the Member remains in the practising class.

3. The Executive Director is directed to impose the following terms, conditions and limitations on the Member’s certificate of registration:

a) The Member will attend two meetings with a Nursing Expert (the “Expert”), at her own expense and within six months from the date that this Order becomes final. To comply, the Member is required to ensure that:

i. The Expert has expertise in nursing regulation and has been approved by the Director of Professional Conduct (the “Director”) in advance of the meetings;

ii. At least seven days before the first meeting, the Member provides the Expert with a copy of:

1. the Panel’s Order,

2. the Notice of Hearing,

3. the Agreed Statement of Facts,

4. this Joint Submission on Order, and

5. if available, a copy of the Panel’s Decision and Reasons;

iii. Before the first meeting, the Member reviews the following College publications and completes the associated Reflective Questionnaires, online learning modules and online participation forms (where applicable):

1. Professional Standards,

2. Confidentiality and Privacy – Personal Health Information,

iv. At least seven days before the first meeting, the Member provides the Expert with a copy of the completed Reflective Questionnaires, online participation forms;

v. Before the first meeting, the Member reviews Circle of Care: Sharing Personal Health Information for Health-Care Purposes, as released by the Information and Privacy Commissioner of Ontario;

vi. The subject of the sessions with the Expert will include:

1. the acts or omissions for which the Member was found to have committed professional misconduct,

2. the potential consequences of the misconduct to the Member’s clients, colleagues, profession and self,

3. strategies for preventing the misconduct from recurring,

4. the publications, questionnaires and modules set out above, and

5. the development of a learning plan in collaboration with the Expert;

vii. Within 30 days after the Member has completed the last session, the Member will confirm that the Expert forwards his/her report to the Director, in which the Expert will confirm:

1. the dates the Member attended the sessions,

2. that the Expert received the required documents from the Member,

3. that the Expert reviewed the required documents and subjects with the Member, and

4. the Expert’s assessment of the Member’s insight into her behaviour;

viii. If the Member does not comply with any one or more of the requirements above, the Expert may cancel any session scheduled, even if that results in the Member breaching a term, condition or limitation on her certificate of registration;

b) For a period of 18 months from the date the Member returns to the practice of nursing, the Member will notify her employers of the decision. To comply, the Member is required to:

i. Ensure that the Director is notified of the name, address, and telephone number of all employer(s) within 14 days of commencing or resuming employment in any nursing position;

ii. Provide her employer(s) with a copy of:

1. the Panel’s Order,

2. the Notice of Hearing,

3. the Agreed Statement of Facts,

4. this Joint Submission on Order, and

5. a copy of the Panel’s Decision and Reasons, once available;

iii. Ensure that within 14 days of the commencement or resumption of the Member’s employment in any nursing position, the employer(s) forward(s) a report to the Director, in which it will confirm:

1. that they received a copy of the required documents, and

2. that they agree to notify the Director immediately upon receipt of any information that the Member has breached the standards of practice of the profession; and

3. All documents delivered by the Member to the College, the Expert or the employer (s) will be delivered by verifiable method, the proof of which the member will retain.

Reasons for Penalty Decision

The Panel understands that the penalty ordered should protect the public and enhance public confidence in the ability of the College to regulate nurses. This is achieved through a penalty that addresses specific deterrence, general deterrence and, where appropriate, rehabilitation and remediation. The Panel also considered the penalty in light of the principle that joint submissions should not be interfered with lightly.

The Panel concluded that the proposed penalty is reasonable and in the public interest. The Member has co-operated with the College and, by agreeing to the facts and a proposed penalty, has accepted responsibility. The Panel finds that the penalty satisfies the principles of specific and general deterrence, rehabilitation and remediation, and public protection.

The penalty is in line with what has been ordered in previous cases.

I, ROBERT MACKAY, Public Member, sign this decision and reasons for the decision as Chairperson of this Discipline panel and on behalf of the members of the Discipline panel as listed below:

Chairperson Date

Panel Members:

Robert MacKay, Public Member

Grace Fox, NP

Shiraz Irani, RN

Mary MacMillan-Gilkinson, Public Member

Heather Stevanka, RN