DISCIPLINE COMMITTEE OF THE COLLEGE OF NURSES OF ONTARIO
PANEL: Terry Holland, RPN Chairperson Grace Fox, NP Member Ashleigh Molloy Public Member Chris Woodbury Public Member Ingrid Wiltshire-Stoby, RN Member
BETWEEN:
COLLEGE OF NURSES OF ONTARIO NICK COLEMAN for College of Nurses of Ontario
- and -
JENNIFER QUINN Reg. No. 09386513 DANIELLE BISNAR for Jennifer Quinn
CHRIS WIRTH Independent Legal Counsel
Heard: April 20, 2018
DECISION AND REASONS
This matter came on for hearing before a panel of the Discipline Committee (the “Panel”) on April 20, 2018 at the College of Nurses of Ontario (“the College”) at Toronto.
The Allegations
The allegations against Jennifer Quinn (the “Member”) as stated in the Notice of Hearing dated January 25, 2018 are as follows.
IT IS ALLEGED THAT:
You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(1) of Ontario Regulation 799/93, in that, while you were employed as a Registered Nurse at Hamilton Health Sciences in Hamilton, Ontario, you contravened a standard of practice of the profession or failed to meet the standard of practice of the profession with respect to accessing personal health information in electronic health records for up to 394 clients, without their consent or other proper authorization, in or about June 2015-May 2016.
You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(37) of Ontario Regulation 799/93, in that, while you were employed as a Registered Nurse at Hamilton Health Sciences in Hamilton, Ontario, you engaged in conduct or performed an act, relevant to the practice of nursing, that, having regard to all the circumstances, would reasonably be regarded by members as disgraceful, dishonourable or unprofessional with respect to accessing personal health information in electronic health records for up to 394 clients, without their consent or other proper authorization, in or about June 2015-May 2016.
Member’s Plea
The Member admitted the allegations set out in paragraphs 1 and 2 in the Notice of Hearing. The Panel received a written plea inquiry which was signed by the Member. The Panel also conducted an oral plea inquiry and was satisfied that the Member’s admission was voluntary, informed and unequivocal.
Agreed Statement of Facts
Counsel for the College and the member advised the Panel that agreement had been reached on the facts and introduced an Agreed Statement of Facts, which reads as follows.
THE MEMBER
Jennifer Quinn (the “Member”) obtained a degree in nursing from McMaster University in 2009.
The Member registered with the College of Nurses of Ontario (the “College”) as a Registered Nurse (“RN”) on June 9, 2009.
The Member was employed at Hamilton Health Sciences – Hamilton General Site (the “Hospital”) from August 16, 2009 to May 30, 2016, when her employment was terminated as a result of the incidents below.
THE HOSPITAL
The Hospital is located in Hamilton, Ontario.
The Hospital used an electronic health record system called Meditech. When Meditech is launched, a privacy notice appears, which states:
It is inappropriate to access a patient’s health record unless you are currently providing care to that individual or have specific authorization from such care giver. Any unauthorized access is a breach of confidentiality and is subject to disciplinary action both within the Hospital and through the professional regulatory bodies.
From 2012 to 2015, the Member worked in the Emergency Department (“ED”). In the ED, the Member had full access to Meditech for all clients in the Hospital, including the ED Tracker. The ED Tracker is a live database that shows the list of all clients in the ED and includes information such as, name, general diagnosis and status (admitted or waiting to be admitted). It is a system used to track client status and manage patient flow.
In June 2015, the Member was transferred to the Integrated Stroke Unit (7S) (the “ISU”). The ISU is an acute care unit. Clients in the ISU are high-acuity clients, often suffering from varying degrees of paralysis and/or neurological issues.
HOSPITAL POLICIES
- The Hospital provided training to staff on privacy and confidentiality. As part of the training, staff were expected to complete an online e-learning module, called “Privacy – Understanding Your Role In Protecting Patient Privacy.” Among other things, the module provided staff with information about the Personal Health Information Protection Act (“PHIPA”), including the concept of Circle of Care. The module states:
Health care providers who are directly providing care to a patient are considered to be within the “circle of care.”
The e-module also provides a link to all of the Hospital’s privacy policies.
On May 25, 2009, the Member signed a Pledge of Confidentiality, agreeing to, among other things, “…access only information which is to be used in the performance of my duties.”
INCIDENTS RELEVANT TO ALLEGATIONS OF PROFESSIONAL MISCONDUCT
In June 2015, when the Member moved from the ED to the ISU, the Hospital failed to adjust her access privileges accordingly and she retained full access to ED electronic medical records, including the ED Tracker. It also failed to provide her with any revised training with respect to her access privileges as applicable to the ISU.
The Member was routinely observed by colleagues, sitting at the nursing station and accessing electronic health records for clients in the ED. After warning the Member on a number of occasions that her conduct was inappropriate, two of the Member’s co-workers reported to management that the Member routinely reviewed ER records, using the ED Tracker.
The Hospital conducted an audit of the Member’s activity in Meditech, which revealed that the Member, between June 2015 and May 2016, had accessed electronic medical records for up to 394 clients who were not in her circle of care. The Member did not have the consent of the clients to access these medical records, nor did she have any other authorization to access the records.
In a meeting with the Hospital, the Member admitted accessing records for clients outside her circle of care. The Member acknowledges that accessing electronic health records for clients outside her circle of care, without consent or other authorization, was a breach of the Hospital’s policies and the College’s standards.
If the Member were to testify, she would state that, in a limited number of cases captured by the Hospital's audit, she had a legitimate professional purpose for accessing the records. For example, in some cases the audit captured accesses consistent with documenting for stroke clients within her circle of care. In other cases, she accessed records of clients who were anticipated to be admitted or re-admitted to the ISU from the ER and whom she had been advised by the Charge Nurse would be assigned to her care. In other cases, the Hospital's audit captured clients who did not have stroke or neurological symptoms but who had been admitted to the ISU as off-service patients and assigned to the Member's care.
COLLEGE STANDARDS
The College issued a Practice Standard titled Confidentiality and Privacy – Personal Health Information (“Practice Standard”). It was first published in 2004 and updated in 2009. It largely addresses PHIPA.
The Practice Standard begins with a general statement about the purpose of practice standards:
Nursing standards are expectations that contribute to public protection. They inform nurses of their accountabilities and the public of what to expect of nurses. Standards apply to all nurses regardless of their role, job description or area of practice.
- The Practice Standard provides key indicators nurses can use to ensure they are meeting the standard, including:
The nurse meets the standard by:
seeking information about issues of privacy and confidentiality of personal health information;
maintaining confidentiality of clients’ personal health information with members of the healthcare team, who are also required to maintain confidentiality, including information that is documented or stored electronically;
maintaining confidentiality after the professional relationship has ended, an obligation that continues indefinitely when the nurse is no longer caring for a client or after a client’s death;
ensuring clients or substitute decision-makers are aware of the general composition of the health care team that has access to confidential information;
collecting only information that is needed to provide care;
not discussing client information with colleagues or the client in public places such as elevators, cafeterias and hallways;
accessing information for her/his clients only and not accessing information for which there is no professional purpose [emphasis added];
safeguarding the security of computerized, printed or electronically displayed or stored information against theft, loss, unauthorized access or use, disclosure, copying, modification or disposal;
not sharing computer passwords; ….
- The Member acknowledges that she was bound by the College’s Practice Standard and that a nurse who breaches those standards and the statutory obligations set out in PHIPA is subject to discipline by the College.
ADMISSIONS OF PROFESSIONAL MISCONDUCT
The Member admits that her unauthorized accesses to personal health information set out in paragraphs 11 to 14 above constitute a breach of the College’s standard on Confidentiality and Privacy – Personal Health Information.
The Member admits that she committed the acts of professional misconduct as alleged in the following paragraphs of the Notice of Hearing:
#1, in that she contravened a standard of practice of the profession or failed to meet the standards of practice of the profession ; and
#2, in that she engaged in conduct or performed an act, relevant to the practice of nursing, that having regard to all the circumstances, would reasonably be regarded by members of the profession as dishonourable and unprofessional.
Decision
The College bears the onus of proving the allegations in accordance with the standard of proof, that being the balance of probabilities based upon clear, cogent and convincing evidence.
Having considered the evidence and the onus and standard of proof, the Panel finds that the Member committed acts of professional misconduct as alleged in paragraph 1 of the Notice of Hearing. The Member failed to meet the standard of practice of the profession with respect to accessing personal health information in electronic health records for up to 394 clients, without their consent or other proper authorization, in or about June 2015-May 2016.
As to allegation #2, the Panel finds that the Member engaged in conduct that would reasonably be considered by members to be dishonourable and unprofessional.
Reasons for Decision
The Panel considered the Agreed Statement of Facts and the Member’s plea and finds that this evidence supports findings of professional misconduct as alleged in the Notice of Hearing.
Allegation #1 in the Notice of Hearing is supported by paragraphs 8 through to and including paragraph 21 in the Agreed Statement of Facts. The College Practice Standard titled Confidentiality and Privacy – Personal Health Information provides guidance and key indicators for nurses in meeting the standard when accessing personal health information. Governing legislation in PHIPA includes parameters on privacy and the concept of circle of care. The Member was not directly providing care for the patients referred to in Allegation #1. The Member signed a Pledge of Confidentiality at her workplace. When the Member was observed by her peers to be looking at restricted information, she disregarded their warnings that the conduct was inappropriate as disclosed in the hospital audit referred to in the Agreed Statement of Facts.
Allegation #2 in the Notice of Hearing is supported by paragraphs 8 to 15 and paragraph 21 with emphasis on paragraph 12, in the Agreed Statement of Facts.
With respect to Allegation # 2, the Panel finds that the Member’s conduct in repetitive access to medical records over the period of 11 months, including disregarding the warnings from her peers, was unprofessional as it demonstrated a serious and persistent disregard for her professional obligations.
The Panel also finds that the Member’s conduct was dishonourable. It demonstrated an element of dishonesty and deceit through the surreptitious nature of breaching clients’ personal health information without consent. The fact that the Member was warned of her behaviour but continued nonetheless, exemplifies the Member’s disregard for the patients; privacy and confidentiality and the College’s Standards.
Penalty
Counsel for the College and the Member advised the Panel that a Joint Submission on Order had been agreed upon. The Joint Submission requests that this Panel make an order as follows.
Requiring the Member to appear before the Panel to be reprimanded within three months of the date that this Order becomes final.
Directing the Executive Director to suspend the Member’s certificate of registration for three months. This suspension shall take effect from the date that this Order becomes final and shall continue to run without interruption as long as the Member remains in the practising class.
Directing the Executive Director to impose the following terms, conditions and limitations on the Member’s certificate of registration:
a) The Member will attend two meetings with a Nursing Expert (the “Expert”), at her own expense and within six months from the date of this Order. To comply, the Member is required to ensure that:
i. The Expert has expertise in nursing regulation and has been approved by the Director of Professional Conduct (the “Director”) in advance of the meetings;
ii. At least seven days before the first meeting, the Member provides the Expert with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
if available, a copy of the Panel’s Decision and Reasons;
iii. Before the first meeting, the Member reviews the following College publications and completes the associated Reflective Questionnaires, online learning modules, decision tools and online participation forms (where applicable):
Professional Standards,
Confidentiality and Privacy – Personal Health Information,
iv. Before the first meeting, the Member reviews Circle of Care: Sharing Personal Health Information for Health-Care Purposes, as released by the Information and Privacy Commissioner of Ontario;
v. At least seven days before the first meeting, the Member provides the Expert with a copy of the completed Reflective Questionnaires, and online participation forms;
vi. The subject of the sessions with the Expert will include:
the acts or omissions for which the Member was found to have committed professional misconduct,
the potential consequences of the misconduct to the Member’s clients, colleagues, profession and self,
strategies for preventing the misconduct from recurring,
the publications, questionnaires and modules set out above, and
the development of a learning plan in collaboration with the Expert;
vii. Within 30 days after the Member has completed the last session, the Member will confirm that the Expert forwards his/her report to the Director, in which the Expert will confirm:
the dates the Member attended the sessions,
that the Expert received the required documents from the Member,
that the Expert reviewed the required documents and subjects with the Member, and
the Expert’s assessment of the Member’s insight into her behaviour;
viii. If the Member does not comply with any one or more of the requirements above, the Expert may cancel any session scheduled, even if that results in the Member breaching a term, condition or limitation on her certificate of registration;
b) For a period of 18 months from the date the Member returns to the practice of nursing, the Member will notify her employers of the decision. To comply, the Member is required to:
i. Ensure that the Director is notified of the name, address, and telephone number of all employer(s) within 14 days of commencing or resuming employment in any nursing position;
ii. Provide her employer(s) with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
a copy of the Panel’s Decision and Reasons, once available;
iii. Ensure that within 14 days of the commencement or resumption of the Member’s employment in any nursing position, the employer(s) forward(s) a report to the Director, in which it will confirm:
that they received a copy of the required documents, and
that they agree to notify the Director immediately upon receipt of any information that the Member has breached the standards of practice of the profession; and
All documents delivered by the Member to the College, the Expert or the employer(s) will be delivered by verifiable method, the proof of which the Member will retain.
Penalty Submissions
Submissions were made by College Counsel stating that the Joint Submission on Order is reflective of the seriousness of the Member’s conduct. Counsel stated that the electronic medical record presents a temptation for others to go “snooping” or looking into patients’ charts outside the circle of care. This becomes a matter of public trust as clients expect nurses to respect their confidentiality and to safeguard their information.
The Member’s Counsel indicated that she agreed with College Counsel’s submissions.
The parties agreed that the mitigating factors in this case were:
a) The Member accepted responsibility for her actions; and
b) The Member cooperated with the College.
Further mitigating factors were that the Member had no prior misconduct with the College and that there was no disclosure of information to other parties. Member’s Counsel also noted that the Member recently changed units at the hospital in 2015 and that the hospital did not adjust the Member’s access to patients’ records in the health record system.
College Counsel submitted that the aggravating factors in this case were:
a) This was not a single incident;
b) It demonstrates a pattern of conduct over a significant period of time; and
c) There was a significant number of clients whose personal health information were accessed.
The proposed penalty addresses the interest of the public, the Member and the profession. The Order shows that the nursing profession is capable of governing itself and of protecting the public interest.
The recommended penalty provides for general deterrence through the oral reprimand and the three month suspension sending a clear message to the membership that unauthorized access to personal health information is a serious breach which will not be tolerated.
The proposed penalty provides specific deterrence through the oral reprimand and suspension and provides for remediation and rehabilitation for the Member with a focus on a review of the publications. The review of College standards and education, personal meetings with a nursing expert, and the 18 month employer notification will lead to the Member’s deeper understanding of misconduct, particularly when the Member has insight into her behaviour.
Overall, the public is protected because the Order sends a message of deterrence to the membership that this conduct is not acceptable. Rehabilitation exercises are aimed to prevent reoccurrence of the conduct when the Member returns to active practice. The Order also demonstrates that the profession is capable of governing itself in the public interest.
Counsel submitted cases to the Panel to demonstrate that the proposed penalty fell within the range of similar cases from this Discipline Committee.
CNO v. Calvano (Discipline Committee, 2015). In this case, the number of patients was very similar (338). The timeframe was approximately two years. The case also proceeded by way of Agreed Statement of Fact and Joint Submission on Order and the penalty included a three month suspension and the same Terms Conditions and Limitations.
CNO v. Edgerton (Discipline Committee, 2016). In this case, the number of inappropriate accesses was similar. There were complicating factors as the member accessed records of extended family members where there was animosity. The member also failed to maintain the appropriate nurse client relationship. This was a more serious case which included the same terms, conditions and limitations with a four month suspension.
CNO v. McLellan (Discipline Committee, 2016). In this case, the conduct in question was the same but the number of accesses was approximately 5800 over a six year period. The suspension ordered was for four months.
Penalty Decision
The Panel accepts the Joint Submission as to Order and accordingly orders:
The Member is required to appear before the Panel to be reprimanded within three months of the date that this Order becomes final.
The Executive Director is directed to suspend the Member’s certificate of registration for three months. This suspension shall take effect from the date that this Order becomes final and shall continue to run without interruption as long as the Member remains in the practising class.
The Executive Director is directed to impose the following terms, conditions and limitations on the Member’s certificate of registration:
a) The Member will attend two meetings with a Nursing Expert (the “Expert”), at her own expense and within six months from the date of this Order. To comply, the Member is required to ensure that:
i. The Expert has expertise in nursing regulation and has been approved by the Director of Professional Conduct (the “Director”) in advance of the meetings;
ii. At least seven days before the first meeting, the Member provides the Expert with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
if available, a copy of the Panel’s Decision and Reasons;
iii. Before the first meeting, the Member reviews the following College publications and completes the associated Reflective Questionnaires, online learning modules, decision tools and online participation forms (where applicable):
Professional Standards,
Confidentiality and Privacy – Personal Health Information,
iv. Before the first meeting, the Member reviews Circle of Care: Sharing Personal Health Information for Health-Care Purposes, as released by the Information and Privacy Commissioner of Ontario;
v. At least seven days before the first meeting, the Member provides the Expert with a copy of the completed Reflective Questionnaires, and online participation forms;
vi. The subject of the sessions with the Expert will include:
the acts or omissions for which the Member was found to have committed professional misconduct,
the potential consequences of the misconduct to the Member’s clients, colleagues, profession and self,
strategies for preventing the misconduct from recurring,
the publications, questionnaires and modules set out above, and
the development of a learning plan in collaboration with the Expert;
vii. Within 30 days after the Member has completed the last session, the Member will confirm that the Expert forwards his/her report to the Director, in which the Expert will confirm:
the dates the Member attended the sessions,
that the Expert received the required documents from the Member,
that the Expert reviewed the required documents and subjects with the Member, and
the Expert’s assessment of the Member’s insight into her behaviour;
viii. If the Member does not comply with any one or more of the requirements above, the Expert may cancel any session scheduled, even if that results in the Member breaching a term, condition or limitation on her certificate of registration;
b) For a period of 18 months from the date the Member returns to the practice of nursing, the Member will notify her employers of the decision. To comply, the Member is required to:
i. Ensure that the Director is notified of the name, address, and telephone number of all employer(s) within 14 days of commencing or resuming employment in any nursing position;
ii. Provide her employer(s) with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
a copy of the Panel’s Decision and Reasons, once available;
iii. Ensure that within 14 days of the commencement or resumption of the Member’s employment in any nursing position, the employer(s) forward(s) a report to the Director, in which it will confirm:
that they received a copy of the required documents, and
that they agree to notify the Director immediately upon receipt of any information that the Member has breached the standards of practice of the profession; and
All documents delivered by the Member to the College, the Expert or the employer(s) will be delivered by verifiable method, the proof of which the Member will retain.
Reasons for Penalty Decision
The Panel understands that the penalty ordered should protect the public and enhance public confidence in the ability of the College to regulate nurses. This is achieved through a penalty that addresses specific deterrence, general deterrence and, where appropriate, rehabilitation and remediation. The Panel also considered the penalty in light of the principle that joint submissions should not be interfered with lightly.
The Panel concluded that the proposed penalty is reasonable and in the public interest. The Member has co-operated with the College and, by agreeing to the facts and a proposed penalty, has accepted responsibility. The Panel finds that the penalty satisfies the principles of specific and general deterrence, rehabilitation and remediation, and public protection. There is specific deterrence to the Member through the oral reprimand and the suspension. There is general deterrence to the membership through the three month suspension. The goal of rehabilitation and remediation is met through the education and meetings with the expert as well as employer notification. The public is protected in the message the suspension sends to the membership. The rehabilitation and employer notification by the member will lead to a better understanding of her professional obligations when she returns to practice.
It is the obligation of each nurse to protect patients’ right to privacy. Breaches of privacy damage the public’s trust in the nursing profession.
The penalty is in line with what has been ordered in previous cases. The increased number of cases involving the breach of confidentiality due to electronic medical records access is a problem which the College and the membership will not tolerate.
I, Grace Fox, NP, sign this decision and reasons on behalf of the Chairperson and the members of the Discipline Panel.
Chairperson Date