DISCIPLINE COMMITTEE OF THE COLLEGE OF NURSES OF ONTARIO
PANEL: SUSAN ROGER, RN Chairperson DAWN CUTLER, RN Member RENATE DAVIDSON Public Member LINA KISKUNAS, RPN Member MARY MACMILLAN-GILKINSON Public Member
BETWEEN:
COLLEGE OF NURSES OF ONTARIO ) JEAN-CLAUDE KILLEY for ) College of Nurses of Ontario
- and - )
ELLEN LOPES ) PHILIP B. ABBINK for Reg. No. 0082735 ) Ellen Lopes
) Heard: February 21, 2017
DECISION AND REASONS
This matter came on for hearing before a panel of the Discipline Committee (the “Panel”) on February 21, 2017 at the College of Nurses of Ontario (“the College”) at Toronto.
Publication Ban
College Counsel requested a ban on the public disclosure, including publication and broadcasting, of the name of the client referred to in the Discipline Hearing and any information that could disclose the identity of the client. The Member’s counsel consented to the order. The Panel granted the motion.
The Allegations
Counsel for the College advised the Panel that the College was requesting leave to withdraw the allegations set out in paragraphs 1 (e) and 2 (e) of the Notice of Hearing dated December 13, 2016. The Panel granted this request. The remaining allegations against Ellen Lopes (the “Member”) are as follows.
IT IS ALLEGED THAT:
- You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(1) of the Ontario Regulation 799/93, in that while working as a Registered Nurse for the [the Hospital Network] in [ ], Ontario (the “Hospital [Network]”), you contravened a standard of practice of the profession or failed to meet the standards of practice of the profession with respect to:
a. accessing a client’s personal health information, without consent or other authorization, on or about September 11, 2014, at 14:24 hours; and/or
b. accessing the same client’s personal health information, without consent or other authorization, on or about September 11, 2014, between 15:05 and 15:08 hours; and/or
c. accessing the same client’s personal health information, without consent or other authorization, on or about September 11, 2014, between 15:20 and 15:21 hours; and/or
d. accessing the same client’s personal health information, without consent or other authorization, on or about September 12, 2014, between 10:41 and 10:42 hours; or
e. [Withdrawn]
- You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(37) of Ontario Regulation 799/93, in that, while employed as a Registered Nurse for the Hospital [Network], you engaged in conduct or performed an act, relevant to the practice of nursing, that, having regard to all the circumstances, would reasonably be regarded by members of the profession as disgraceful, dishonourable or unprofessional with respect to:
a. accessing a client’s personal health information, without consent or other authorization, on or about September 11, 2014, at 14:24 hours; and/or
b. accessing the same client’s personal health information, without consent or other authorization, on or about September 11, 2014, between 15:05 and 15:08 hours; and/or
c. accessing the same client’s personal health information, without consent or other authorization, on or about September 11, 2014, between 15:20 and 15:21 hours; and/or
d. accessing the same client’s personal health information, without consent or other authorization, on or about September 12, 2014, between 10:41 and 10:42 hours; or
e. [Withdrawn]
Member’s Plea
The Member admitted the allegations set out in paragraphs 1 (a) (b) (c) (d) and 2 (a) (b) (c) (d) in the Notice of Hearing. The Panel received a written plea inquiry which was signed by the Member. The Panel also conducted an oral plea inquiry and was satisfied that the Member’s admission was voluntary, informed and unequivocal.
Agreed Statement of Facts
Counsel for the College and the Member advised the Panel that agreement had been reached on the facts and introduced an Agreed Statement of Facts, which reads as follows.
THE MEMBER
Ellen Lopes (the “Member”) obtained a diploma in nursing from Humber College in 2000.
The Member registered with the College of Nurses of Ontario (the “College”) as a Registered Nurse (“RN”) on May 8, 2000.
The Member worked full-time at [the Hospital Network] from May 2000 to September 22, 2014 when her employment was terminated as a result of this incident.
From October 2013 to September 2014, the Member worked as a Clinical Nurse Coordinator in the [the Clinic] (the “Clinic”). She divided her time between three sites: [Hospital A], [Hospital B], and the radiology clinic at [the Hospital], on Thursday mornings only.
THE CLIENT
[The Client] was [ ] years old at the time of the incident.
The Client was on [the Unit] at the Hospital.
At the time of the incident, the Client was [ ]. [The Client’s] admission to the Hospital and [ ] general diagnosis were widely publicized.
The Member was never in the Client’s circle of care.
[ ] SYSTEM
[The Hospital Network] uses an electronic documentation system for clinical entries/results regarding medical imaging procedures called [ ]. The [ ] software is specific to radiology and is owned by [the Hospital Network], but radiology staff at the Hospital can also use the system. For continuity of care, [the Hospital Network] staff with access to [ ] could search for a client of [Hospital A], [Hospital B], or the Hospital, if that client had previously had imaging. Therefore, the Member had access to the Hospital’s client records as well as [Hospital A] and [Hospital B] records.
Regardless of their ability to access medical imaging records in [ ], radiology staff were only permitted to do so if they were in the client’s circle of care, pursuant to the Personal Health Information Protection Act (“PHIPA”), the College’s Practice Standard and [the Hospital Network’s] policies.
HOSPITAL POLICY
[The Hospital Network] had policies titled “Information Security & Appropriate Use of Technology” and “Privacy”. The policies adopted PHIPA and its standards for the collection, use and disclosure of personal health information. They prohibited unauthorized access to personal health information (PHI), and defined PHI to include “a name, medical record number, health insurance number, address, telephone number, and personal health information related to a patient’s care such as test results…”
The Member signed a Confidentiality and Security Agreement on May 17, 2000 which stated, “Except when I am legally authorized or required to do so, I will not access confidential information…”
COLLEGE STANDARDS
The College issued a Practice Standard titled Confidentiality and Privacy – Personal Health Information (“Practice Standard”). It was first published in 2004 and updated in 2009. It largely addresses PHIPA.
The Practice Standard begins with a general statement about the purpose of practice standards:
Nursing standards are expectations that contribute to public protection. They inform nurses of their accountabilities and the public of what to expect of nurses. Standards apply to all nurses regardless of their role, job description or area of practice.
- The Practice Standard provides key indicators nurses can use to ensure they are meeting the standard, including:
The nurse meets the standard by:
seeking information about issues of privacy and confidentiality of personal health information;
maintaining confidentiality of clients’ personal health information with members of the healthcare team, who are also required to maintain confidentiality, including information that is documented or stored electronically;
maintaining confidentiality after the professional relationship has ended, an obligation that continues indefinitely when the nurse is no longer caring for a client or after a client’s death;
ensuring clients or substitute decision-makers are aware of the general composition of the health care team that has access to confidential information;
collecting only information that is needed to provide care;
not discussing client information with colleagues or the client in public places such as elevators, cafeterias and hallways;
accessing information for her/his clients only and not accessing information for which there is no professional purpose;
safeguarding the security of computerized, printed or electronically displayed or stored information against theft, loss, unauthorized access or use, disclosure, copying, modification or disposal;
not sharing computer passwords; … [emphasis added]
- The Member acknowledges that she was bound by the College’s Practice Standard and that a nurse who breaches those standards and the statutory obligations set out in PHIPA is subject to discipline by the College.
INCIDENTS RELEVANT TO ALLEGATIONS OF PROFESSIONAL MISCONDUCT
In September 2014, at the request of the Hospital, [the Hospital Network] conducted an internal audit of its electronic document systems, including [ ] and [ ], with respect to accesses to the Client’s health record. The audit revealed that the Member’s log in code was used to access the personal health record of the Client in [ ], on multiple occasions.
The searches and accesses were as follows:
on September 11, 2014, at 14:24, the Member searched for “[the Client]” and clicked on a procedure record;
on September 11, 2014, between 15:05 and 15:08, the Member searched twice for [the Client], then twice for [the Client], then clicked on three procedure records;
on September 11, 2014, between 15:20 and 15:21, the Member searched for [the Client], then clicked on four procedure records; and
on September 12, 2014, between 10:41 and 10:42, the Member searched for [the Client], then clicked on four procedure records.
The Member was at her workstation one minute before the first access, documenting in [Client A]’s record at 14:23.
The Member was present at her workstation between the first and second accesses, documenting in [Client B]’s record between 14:40 and 14:45. She then accessed [Client C]’s record at 15:02, just three minutes before searching for [the Client] at 15:05.
The Member logged out after the second access at 15:08. She then logged in at 15:09, using her discreet and confidential login credentials.
The Member began the third set of accesses only 11 minutes later, at 15:20. She was then present at her workstation at 15:47, documenting in [Client D]’s record.
On September 12, 2014, the Member logged in at 10:30, and was present at her workstation at 10:35, documenting in [Client E]’s record. Only six minutes later, at 10:41, she searched for the Client’s record and accessed four procedures.
The Client was being treated in a different unit of the Hospital at the time these accesses were made by the Member at [Hospital A] and [Hospital B] respectively. The Member was not within the circle of care for the Client, as he was never a client at the Clinic up to this date.
However, the Client did undergo certain imaging procedures on September 11 and 12, 2014 at the Hospital, and the Member’s accesses track entries for those procedures being made by the Client’s health care team. For example, at 14:24, the Member accessed a [ ] procedure that had started at 14:17. At 15:06, she accessed a [ ] procedure that started at 14:20. At 15:20, she looked again at the [ ] procedures started at 14:17 and 14:20, which were still underway. On the morning of September 12, she accessed procedures, including an [ ], that had been underway in the late afternoon and evening of September 11, 2014.
The audit results demonstrate that the Member’s log in account was used to access the Client’s test results some 12 times. The audit report confirms the accesses to the Client’s medical imaging procedures, which contain PHI within the meaning of PHIPA, the [the Hospital Network’s] policies and the College’s Practice Standard.
ADMISSIONS OF PROFESSIONAL MISCONDUCT
The Member admits that her unauthorized accesses to the Client’s personal health information, set out in paragraphs 17 to 26 above, constitute a breach of the College’s standard on Confidentiality and Privacy – Personal Health Information, as well as conduct which members would reasonably regard as dishonourable and unprofessional.
The Member admits that she committed the acts of professional misconduct as alleged in the following paragraphs of the Notice of Hearing:
1(a), (b), (c) and (d), in that she contravened a standard of practice of the profession or failed to meet the standards of practice of the profession; and
2(a), (b), (c) and (d), in that she engaged in conduct or performed an act, relevant to the practice of nursing, that having regard to all the circumstances, would reasonably be regarded by members of the profession as dishonourable and unprofessional.
- The College withdraws allegations 1(e) and 2(e).
Decision
The Panel finds that the Member committed acts of professional misconduct as alleged in paragraphs 1 (a) (b) (c) (d) and 2 (a) (b) (c) (d) of the Notice of Hearing. As to allegation 2, the Panel finds that the Member engaged in conduct that would reasonably be considered by members to be dishonourable and unprofessional.
Reasons for Decision
The Panel considered the Agreed Statement of Facts and the Member’s plea and finds that this evidence supports findings of professional misconduct as alleged in the Notice of Hearing.
Allegation #1 in the Notice of Hearing is supported by paragraphs 13-26 in the Agreed Statement of Facts. The standards of practice are clear that nurses should only access confidential health information of clients who are in their circle of care. In this particular case, the Member was not in the client’s circle of care.
Allegation #2 in the Notice of Hearing is supported by paragraphs 9-12 and 17-26 in the Agreed Statement of Facts.
With respect to Allegation #2, the Panel finds that the Member’s conduct was unprofessional in that, on several occasions, she accessed a Client’s personal health information. The Client was not in her circle of care. These actions demonstrate a serious and persistent disregard for her professional obligations. The Panel also concludes that this conduct is dishonourable in that it falls well below the standards expected of a professional. The Member ought to have known that her conduct was unacceptable when she surreptitiously accessed the unauthorized medical files of the Client.
Penalty
Counsel for the College and the Member advised the Panel that a Joint Submission on Order had been agreed upon. The Joint Submission requests that this Panel make an order as follows.
Requiring the Member to appear before the Panel to be reprimanded within three months of the date that this Order becomes final.
Directing the Executive Director to suspend the Member’s certificate of registration for two months. This suspension shall take effect from the date that this Order becomes final and shall continue to run without interruption as long as the Member remains in the practising class.
Directing the Executive Director to impose the following terms, conditions and limitations on the Member’s certificate of registration:
a) The Member will attend a minimum of one meeting with a Nursing Expert (the “Expert”) at her own expense and within three months from the date of this Order. If the Expert determines that a further meeting is required, the Expert will advise the Director of Professional Conduct (the “Director”) regarding the length of time required to complete the additional meeting. The maximum number of meetings shall not exceed two meetings and all meetings shall be completed within six months from the date of this Order. To comply, the Member is required to ensure that:
i. The Expert has expertise in nursing regulation and has been approved by the Director in advance of the meetings;
ii. At least seven days before the first meeting, the Member provides the Expert with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
if available, a copy of the Panel’s Decision and Reasons;
iii. Before the first meeting, the Member reviews the following College publications and completes the associated Reflective Questionnaires, online learning modules and online participation forms (where applicable):
Professional Standards,
Confidentiality and Privacy - Personal Health Information;
iv. Before the first meeting, the Member reviews Circle of Care: Sharing Personal Health Information for Health-Care Purposes, as released by the Information and Privacy Commissioner of Ontario;
v. At least seven days before the first meeting, the Member provides the Expert with a copy of the completed Reflective Questionnaires, and online participation forms;
vi. The subject of the session(s) with the Expert will include:
the acts or omissions for which the Member was found to have committed professional misconduct,
the potential consequences of the misconduct to the Member’s clients, colleagues, profession and self,
strategies for preventing the misconduct from recurring,
the publications, questionnaires and modules set out above, and
the development of a learning plan in collaboration with the Expert;
vii. Within 30 days after the Member has completed the last session, the Member will confirm that the Expert forwards his/her report to the Director, in which the Expert will confirm:
the dates the Member attended the sessions,
that the Expert received the required documents from the Member,
that the Expert reviewed the required documents and subjects with the Member, and
the Expert’s assessment of the Member’s insight into her behaviour;
viii. If the Member does not comply with any one or more of the requirements above, the Expert may cancel any session scheduled, even if that results in the Member breaching a term, condition or limitation on her certificate of registration;
b) For a period of 18 months from the date the Member’s suspension ends, the Member will notify her employers of the decision. To comply, the Member is required to:
i. Ensure that the Director is notified of the name, address, and telephone number of all employer(s) within 14 days of commencing or resuming employment in any nursing position;
ii. Provide her employer(s) with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
a copy of the Panel’s Decision and Reasons, once available;
iii. Ensure that within 14 days of the commencement or resumption of the Member’s employment in any nursing position, the employer(s) forward(s) a report to the Director, in which it will confirm:
that they received a copy of the required documents, and
that they agree to notify the Director immediately upon receipt of any information that the Member has breached the standards of practice of the profession.
All documents delivered by the Member to the College, the Expert or the employer(s) will be delivered by verifiable method, the proof of which the Member will retain.
Penalty Submissions
Submissions were made by College Counsel. The Member’s Counsel indicated that he agreed with those submissions.
The parties agreed that the mitigating factors in this case were as follows.
The Member admitted to the allegations, accepted responsibility for her actions and cooperated with the College.
The Member has been an RN for almost 17 years. This is her first offence.
The breach involved a single Client.
The Member’s Counsel also emphasized that there were no allegations of improper use of the unauthorized information or improper disclosure of the information.
The Member has been terminated from her employment as a result of her conduct.
The aggravating factors in this case were as follows.
The unauthorized access of personal health records is very serious.
The Member used her log-in code to access the personal health record of the Client on multiple occasions over a two-day period.
The proposed two month suspension provides for general deterrence as it conveys to the Member and the profession that such unauthorized access of medical health records is unprofessional and dishonourable. This suspension sends a strong message to the membership that, when there is such a serious breach of trust, sanctions will be imposed.
The proposed penalty provides for specific deterrence through the oral reprimand, two month suspension and the requirement of employer notification for 18 months.
The proposed penalty provides for remediation and rehabilitation through the terms, conditions and limitations as well as the meetings with a nursing expert. This will help to reintegrate the Member back into the nursing profession.
Overall, the public is protected because the Member will be given a two-month suspension where she will meet, at least once, with a Nursing Expert. The Member will have the time and opportunity to reflect on this specific act of professional misconduct. For 18 months, the Member’s employer will be aware of this decision and the Panel’s findings.
College Counsel submitted three cases to the Panel to demonstrate that the proposed penalty fell within the range of similar cases from the Discipline Committee.
CNO v. Calvano (Discipline Committee, 2015) involved the unauthorized access of 338 clients’ personal health information through the misuse of electronic medical records. The member was given a three month suspension and was required to attend two meetings with a Nursing Expert.
CNO v. Dhaliwal (Discipline Committee, 2016). In this case, the member accessed the medical records of two clients, two times each. The member was suspended for two months and was required to meet twice with a Nursing Expert.
CNO v. Ann H.A. Raeburn-Lewis (Discipline Committee, 2016). This involved a single unauthorized access of the personal health information of one client. The Member was given a one month suspension, two meetings with a Nursing Expert and an 18 month period of employer notification.
The Member’s Counsel provided the Panel with two cases.
CNO v. Smith (Discipline Committee, 2008) In this case, the Member accessed a client’s record on several occasions and disclosed information about the client without consent. The Member was given a six week suspension as well as various terms, conditions and limitations.
R. v. Anthony-Cook, 2016 SCC 43. This case was provided to the Panel to reinforce the importance of relying on joint submissions which bring together the interests of both the public and the accused. In that case the Supreme Court of Canada wrote: “Agreements of this nature are commonplace and vitally important to the well-being of our criminal justice system, as well as our justice system at large.”
Penalty Decision
The Panel accepts the Joint Submission as to Order and accordingly orders:
The Member shall appear before the Panel to be reprimanded within three months of the date that this Order becomes final.
The Executive Director is directed to suspend the Member’s certificate of registration for two months. This suspension shall take effect from the date that this Order becomes final and shall continue to run without interruption as long as the Member remains in the practising class.
The Executive Director is directed to impose the following terms, conditions and limitations on the Member’s certificate of registration:
a) The Member will attend a minimum of one meeting with a Nursing Expert (the “Expert”) at her own expense and within three months from the date of this Order. If the Expert determines that a further meeting is required, the Expert will advise the Director of Professional Conduct (the “Director”) regarding the length of time required to complete the additional meeting. The maximum number of meetings shall not exceed two meetings and all meetings shall be completed within six months from the date of this Order. To comply, the Member is required to ensure that:
i. The Expert has expertise in nursing regulation and has been approved by the Director in advance of the meetings;
ii. At least seven days before the first meeting, the Member provides the Expert with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
if available, a copy of the Panel’s Decision and Reasons;
iii. Before the first meeting, the Member reviews the following College publications and completes the associated Reflective Questionnaires, online learning modules and online participation forms (where applicable):
Professional Standards,
Confidentiality and Privacy - Personal Health Information;
iv. Before the first meeting, the Member reviews Circle of Care: Sharing Personal Health Information for Health-Care Purposes, as released by the Information and Privacy Commissioner of Ontario;
v. At least seven days before the first meeting, the Member provides the Expert with a copy of the completed Reflective Questionnaires, and online participation forms;
vi. The subject of the session(s) with the Expert will include:
the acts or omissions for which the Member was found to have committed professional misconduct,
the potential consequences of the misconduct to the Member’s clients, colleagues, profession and self,
strategies for preventing the misconduct from recurring,
the publications, questionnaires and modules set out above, and
the development of a learning plan in collaboration with the Expert;
vii. Within 30 days after the Member has completed the last session, the Member will confirm that the Expert forwards his/her report to the Director, in which the Expert will confirm:
the dates the Member attended the sessions,
that the Expert received the required documents from the Member,
that the Expert reviewed the required documents and subjects with the Member, and
the Expert’s assessment of the Member’s insight into her behaviour;
viii. If the Member does not comply with any one or more of the requirements above, the Expert may cancel any session scheduled, even if that results in the Member breaching a term, condition or limitation on her certificate of registration;
b) For a period of 18 months from the date the Member’s suspension ends, the Member will notify her employers of the decision. To comply, the Member is required to:
i. Ensure that the Director is notified of the name, address, and telephone number of all employer(s) within 14 days of commencing or resuming employment in any nursing position;
ii. Provide her employer(s) with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
a copy of the Panel’s Decision and Reasons, once available;
iii. Ensure that within 14 days of the commencement or resumption of the Member’s employment in any nursing position, the employer(s) forward(s) a report to the Director, in which it will confirm:
that they received a copy of the required documents, and
that they agree to notify the Director immediately upon receipt of any information that the Member has breached the standards of practice of the profession.
All documents delivered by the Member to the College, the Expert or the employer(s) will be delivered by verifiable method, the proof of which the Member will retain.
Reasons for Penalty Decision
The Panel understands that the penalty ordered should protect the public and enhance public confidence in the ability of the College to regulate nurses. The Panel wants to send a strong message to the public and the profession that the unauthorized access of a client’s personal health information, with no professional purpose, is extremely serious and that sanctions will be leveled. This is achieved through a penalty that addresses specific deterrence, general deterrence and, where appropriate, rehabilitation and remediation. The Panel also considered the penalty in light of the principle that joint submissions should not be interfered with lightly.
The Panel concluded that the proposed penalty is reasonable and in the public interest. The Member has co-operated with the College and, by agreeing to the facts and a proposed penalty, has accepted responsibility. The Panel finds that the penalty satisfies the principles of specific and general deterrence, rehabilitation and remediation, and public protection. Members of the profession will be reminded that they have an obligation to adhere to their professional standards, hospital policies and government privacy regulation.
The penalty is in line with what has been ordered in previous cases.
I, Susan Roger, RN, sign this decision and reasons for the decision as Chairperson of this Discipline panel and on behalf of the members of the Discipline panel.
Chairperson Date
