DISCIPLINE COMMITTEE OF THE COLLEGE OF NURSES OF ONTARIO
PANEL: Dawn Cutler, RN Chairperson Renate Davidson Public Member Heather Stevanka, RN Member Sherry Szucsko-Bedard, RN Member Devinder Walia Public Member
BETWEEN:
COLLEGE OF NURSES OF ONTARIO MEGAN SHORTREED for College of Nurses of Ontario
- and -
LINDA MARIE EVOY Registration No. 0188615 DANIELLE BISNAR for Linda Marie Evoy
PATRICIA HARPER Independent Legal Counsel
Heard: August 22, 2019
DECISION AND REASONS
This matter came on for hearing before a panel of the Discipline Committee (the “Panel”) on August 22, 2019, the College of Nurses of Ontario (the “College”) at Toronto.
Linda Marie Evoy (the “Member”) was present and represented by counsel.
Publication Ban
College Counsel brought a motion pursuant to s.45(3) of the Health Professions Procedural Code of the Nursing Act, 1991, for an order preventing the public disclosure, of the identities of the patients referred to orally or in any documents presented in the Discipline hearing of the Member, or any information that could disclose the identity of the patients, including a ban on the publication or broadcasting of this information.
The panel considered the submissions of the parties and decided that there be an order preventing the public disclosure of the identities of the patients referred to orally or in any documents presented in the Discipline hearing of the Member, or any information that could disclose the identity of the patients, including ban on the publication or broadcasting of this information.
The Allegations
College Counsel advised the Panel that the College was requesting leave to withdraw the allegations set out in paragraph 1 as it pertains to [ ] [Patient A], [Patient E], [Patient F], [Patient M], paragraph 2, paragraph 3(a) as it pertains to patients [Patient A], [Patient E], [Patient F], [Patient M] and paragraph 3(b) of the Notice of Hearing dated June 19, 2019. The Panel granted this request.
The remaining allegations against the Member as set out in the Notice of Hearing are as follows:
IT IS ALLEGED THAT:
- You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(1) of Ontario Regulation 799/93, in that while you were employed as a Registered Nurse at Blind River District Health Centre – Matthews Memorial Hospital in Blind River, Ontario, you contravened a standard of practice of the profession or failed to meet the standard of practice of the profession with respect to accessing personal health information without consent or other proper authorization, for one or more of the following clients on or about the dates indicated below:
Client Name
Date of Access
Withdrawn
[Patient B]
August 6, 2013 at 02:49 hours September 6, 2015 at 10:04 hours September 6, 2015 at 11:16 hours
[Patient C]
November 27, 2015 at 21:41 hours
[Patient D]
November 28, 2015 at 00:15 hours November 28, 2015 at 19:44 hours November 29, 2015 at 21:41 hours December 2, 2015 at 20:18 hours December 3, 2015 at 21:50 hours December 7, 2015 at 21:14 hours December 8, 2015 at 22:22 hours
Withdrawn
Withdrawn
[Patient G]
December 7, 2015 at 20:46 hours
[Patient H]
June 5, 2013 at 20:04 hours June 19, 2013 at 21:47 hours
[Patient I]
May 17, 2013 at 20:38 hours
[Patient J]
February 26, 2014 at 20:01 hours February 22, 2015 at 20:27 hours February 25, 2015 at 20:28 hours
[Patient K]
February 26, 2015 at 01:29 hours
[Patient L]
November 6, 2014 at 19:30 hours
Withdrawn
[Patient N]
July 1, 2015 at 19:49 hours July 6, 2015 at 20:03 hours
[Patient O]
July 15, 2015 at 07:40 hours August 18, 2015 at 00:05 hours
and/or;
[Withdrawn]; and/or
You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(37) of Ontario Regulation 799/93, in that while you were employed as a Registered Nurse at Blind River District Health Centre – Matthews Memorial Hospital in Blind River, Ontario, you engaged in conduct or performed an act, relevant to the practice of nursing, that, having regard to all the circumstances, would reasonably be regarded by members of the profession as disgraceful, dishonourable or unprofessional with respect to:
a. accessing personal health information without consent or proper authorization, for one or more of the following clients on or about the dates indicated below:
Client Name
Date of Access
Withdrawn
[Patient B]
August 6, 2013 at 02:49 hours September 6, 2015 at 10:04 hours September 6, 2015 at 11:16 hours
[Patient C]
November 27, 2015 at 21:41 hours
[Patient D]
November 28, 2015 at 00:15 hours November 28, 2015 at 19:44 hours November 29, 2015 at 21:41 hours December 2, 2015 at 20:18 hours December 3, 2015 at 21:50 hours December 7, 2015 at 21:14 hours December 8, 2015 at 22:22 hours
Withdrawn
Withdrawn
[Patient G]
December 7, 2015 at 20:46 hours
[Patient H]
June 5, 2013 at 20:04 hours June 19, 2013 at 21:47 hours
[Patient I]
May 17, 2013 at 20:38 hours
[Patient J]
February 26, 2014 at 20:01 hours February 22, 2015 at 20:27 hours February 25, 2015 at 20:28 hours
[Patient K]
February 26, 2015 at 01:29 hours
[Patient L]
November 6, 2014 at 19:30 hours
Withdrawn
[Patient N]
July 1, 2015 at 19:49 hours July 6, 2015 at 20:03 hours
[Patient O]
July 15, 2015 at 07:40 hours August 18, 2015 at 00:05 hours
and/or;
b. [Withdrawn];
- You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(37) of Ontario Regulation 799/93, in that while you were a Registered Nurse, you engaged in conduct or performed an act, relevant to the practice of nursing, that, having regard to all the circumstances, would reasonably be regarded by members of the profession as disgraceful, dishonourable or unprofessional when you impersonated [your family member], [Patient J], on a voicemail left at Sault Area Hospital on or around May 13, 2016 in connection with your access of [Patient J]’s personal health information without consent or proper authorization.
Member’s Plea
The Member admitted the allegations set out in paragraphs 1, 3(a) and 4 in the Notice of Hearing. The Panel received a written plea inquiry which was signed by the Member. The Panel also conducted an oral plea inquiry and was satisfied that the Member’s admission was voluntary, informed and unequivocal.
Agreed Statement of Facts
College Counsel and the Member‘s Counsel advised the Panel that agreement had been reached on the facts and introduced an Agreed Statement of Facts, which reads unedited as follows:
THE MEMBER
Linda Marie Evoy (the “Member”) obtained a diploma in nursing from Sault College in 2001.
The Member was registered with the College of Nurses of Ontario (“CNO”) as a Registered Practical Nurse from October 27, 1989 until January 3, 2002, when she resigned her RPN certificate. On May 30, 2001, the Member registered with CNO as a Registered Nurse (“RN”).
The Member was employed as a full-time staff and charge nurse at Blind River District Health Centre (“BRDHC”) – Matthews Memorial Hospital (“Matthews Memorial”), located in Richards Landing, Ontario from April 1, 2013 to January 13, 2016, when she was terminated as a result of the incidents described below.
From 2017 to 2019, the Member was employed on a fixed term basis by Algoma Treatment & Remand Centre, a medium/maximum security prison in Sault Ste. Marie, Ontario
THE FACILITY
BRDHC operates three hospital sites: Blind River, Thessalon and Matthews Memorial, and is part of a network of 22 hospitals called “North East LHIN” or “NEON”. Staff working at any of the facilities that are part of NEON have access to patient records at all NEON facilities. Sault Area Hospital ("SAH") is not part of NEON.
BRDHC took over the Matthews Memorial site from SAH in 2013. Matthews Memorial only operates an emergency department, with no inpatient beds and limited diagnostic services. The Member worked for SAH beginning in 2001. In January 2010, she began working at the Matthews Memorial emergency department, when it was still operated by SAH.
At the time of the incidents described below, Matthews Memorial used a combination of electronic and paper records and charting.
Staff at Matthews Memorial had access to the NEON/BRDHC’s Meditech system and the SAH’s Meditech system.
Nurses at Matthews Memorial had been granted special authorization to access lab diagnostics, nuclear imaging and similar information from the SAH Meditech system for patients under their care.
HOSPITAL POLICIES
BRDHC had a policy titled “Confidentiality (Privacy) and Security of Personal Health Information and Personal Information.” This policy outlined the hospital’s commitment to “collecting, using and disclosing personal health information and personal information in a responsible fashion, and only to the extent necessary for the services we provide.”
The policy contained a section called “Limiting Use and Disclosure of Personal Health Information”, which stated that “Accesses to confidential information is limited to only those employees authorized to hold, view or handle such information for their current job duties. Access is to be determined by the employee’s direct supervisor.”
Further, under “Individual Access to Own Personal Health Information”, the policy allowed access to a patient’s own personal health information “upon request”. The hospital would vet the information to be disclosed, and “may choose to make sensitive medical information available through a medical practitioner.”
A separate policy called, “Disclosure of Personal Health Information to Family or Friends”, set out a procedure which required the hospital to “Verify that the patient or substitute decision-maker has consented to the disclosure of the personal health information to the patient’s family members or friends.” In practice, this involved the filing of a written consent form with the hospital’s administration as set out in the BRDHC policy on “Access & Release of Personal Health Information”, and the charging of a fee.
Under a policy called “Access to Client Records”, BRDHC made clear that “X-ray and Ultrasound images or reports must not be viewed with the client by anyone other than the attending physician or specialist.”
Finally, under a policy called, “Discipline for a Privacy Breach of Personal Health Information and Personal Information”, BRDHC set out what constituted a privacy breach, including:
Accessing anyone’s personal health information or an employee’s personal information when it is not required to provide or maintain care to a patient or resident or in the performance of duties…;
Accessing the health record or employee record of oneself other than through the documented procedure in the BRDHC policy on “Release of Information”; and
Accessing the health record or employee record of a staff member, family member, friend, or anyone for whom you do not have a requirement to view information based on providing care or performing duties.
- The Member was required to be cognizant of and compliant with these policies and procedures, and completed training respecting these policies before the incidents described below.
CNO STANDARDS
CNO issued a Practice Standard titled, Confidentiality and Privacy – Personal Health Information (“Practice Standard”). It was first published in 2004 and updated in 2009. It largely incorporates the Personal Health Information Protection Act (“PHIPA”).
The Practice Standard begins with a general statement about the purpose of practice standards:
Nursing standards are expectations that contribute to public protection. They inform nurses of their accountabilities and the public of what to expect of nurses. Standards apply to all nurses regardless of their role, job description or area of practice.
- The Practice Standard provides key indicators nurses can use to ensure they are meeting the standard, including:
The nurse meets the standard by:
seeking information about issues of privacy and confidentiality of personal health information;
maintaining confidentiality of clients’ personal health information with members of the healthcare team, who are also required to maintain confidentiality, including information that is documented or stored electronically;
maintaining confidentiality after the professional relationship has ended, an obligation that continues indefinitely when the nurse is no longer caring for a client or after a client’s death;
ensuring clients or substitute decision-makers are aware of the general composition of the health care team that has access to confidential information;
collecting only information that is needed to provide care;
not discussing client information with colleagues or the client in public places such as elevators, cafeterias and hallways;
accessing information for her/his clients only and not accessing information for which there is no professional purpose; [emphasis added]
safeguarding the security of computerized, printed or electronically displayed or stored information against theft, loss, unauthorized access or use, disclosure, copying, modification or disposal; [and]
not sharing computer passwords; …
- The Member acknowledges that she was bound by CNO’s Practice Standard and that a nurse who breaches those standards and the statutory obligations set out in PHIPA is subject to discipline by CNO.
INCIDENTS RELEVANT TO ALLEGATIONS OF PROFESSIONAL MISCONDUCT
Improper Access to Patient Records
- The Member admits accessing personal health information, without consent or other proper authorization, for the following patients for whom she was not a member of the health care team or in the circle of care at the time of the accesses, on or about the dates indicated below:
[Patient] Name
Date of Access
Reason Access was Improper
[Patient B]
August 6, 2013 at 0249 hours September 6, 2015 at 1004 hours September 6, 2015 at 1116 hours
Family member; not in circle of care.
[Patient C]
November 27, 2015 at 2141 hours
[Parent] of patient anticipated to arrive by ambulance; not in circle of care.
[Patient D]
November 28, 2015 at 0015 hours November 28, 2015 at 1944 hours November 29, 2015 at 2141 hours December 2, 2015 at 2018 hours December 3, 2015 at 2150 hours December 7, 2015 at 2114 hours December 8, 2015 at 2222 hours
[Spouse] of former employee of Matthews Memorial; not in circle of care.
[Patient G]
December 7, 2015 at 2046 hours
Member’s own health record; not in circle of care.
[Patient H]
June 5, 2013 at 2004 hours June 19, 2013 at 2147 hours
Family member; not in circle of care.
[Patient I]
May 17, 2013 at 2038 hours
Family member; not in circle of care.
[Patient J]
February 26, 2014 at 2001 hours February 22, 2015 at 2027 hours February 25, 2015 at 2028 hours
Family member; not in circle of care.
[Patient K]
February 26, 2015 at 0129 hours
Not proximate to dates as patient; not in circle of care.
[Patient L]
November 6, 2014 at 1930 hours
Not proximate to dates as patient; not in circle of care.
[Patient N]
July 1, 2015 at 1949 hours July 6, 2015 at 2003 hours
Not proximate to dates as patient; not in circle of care.
[Patient O]
August 18, 2015 at 0005 hours
Not proximate to dates as patient; not in circle of care.
Improper Accesses to [Patient D]’s Records Result in an Audit
[Patient D]'s spouse had previously worked at Matthews Memorial [ ]. [Patient D] had previously been admitted to Matthews Memorial before being transferred to the [ ] unit at SAH. The Member was not part of [Patient D’s] healthcare team.
Due to a report by a co-worker, Matthews Memorial contacted SAH and requested that an audit be conducted on the Member’s accesses to [Patient D]’s electronic chart. The audit revealed that the Member accessed the chart on six occasions between November 28 and December 8, 2015. The time spent reviewing the record on these accesses ranged from 0 to 23 minutes and included the following pages: visit, summary, 24 hour, laboratory, blood bank, imaging, medications, other reports, summary, order history and notes.
As a result, further electronic audits were conducted dating back to 2013. These audits revealed that the Member had reviewed the personal health information of her family members, co-workers and patients who were no longer receiving care at Matthews Memorial.
Improper Accesses to Family Members’ Records
[Patient B], [Patient H], [Patient I] and [Patient J] were members of the Member’s family. The Member was not part of their health care team, and accessed their records in her capacity as a family member, without following the appropriate process or filing the required consent forms for patients or their family members to access their records. While the Member would testify that she had verbal consent from her family members to access their records, she acknowledges that she abused her position as a nurse by making the accesses without following the proper procedure or filing written consent as required.
[Patient B] is the Member’s [family member]. The Audit reveals that the Member accessed [Patient B]’s chart on August 6, 2013, at 0249 hours for 21 minutes, at which time she reviewed the Summary page from 2012. The Member again accessed his chart on September 6, 2015, at 1004 for 1 minute and 1116 hours for 4 minutes. During that time, she reviewed the 24-Hour page, Medications, and Other History pages from 2015.
Matthews Memorial had no written consent on file for the Member to access [Patient B]’s records. He was not admitted to Matthews Memorial at the time when the Member accessed his charts. The Member admits that she had no clinical purpose or proper authorization to access [Patient B]’s personal health information.
[Patient H] is the Member’s [family member]. During the material time period, he received a diagnosis of [ ]. On June 5 and 19, 2013, the Member accessed his Imaging and Summary pages.
If the Member were to testify, she would say that [Patient H] had recently had [ ], and asked the Member to access his chart to help explain to him what his physician had told him. However, the Member admits that she failed to follow proper procedures to access the records as she was not part of his healthcare team. The Member admits that she did not have a clinical purpose or proper authorization to access [Patient H]’s personal health information.
[Patient I] is the Member’s [family member]. She was treated at Matthews Memorial on May 3, 2013 at 1416 hours for [ ]. The Member accessed her chart on May 17, 2013 at 2038 hours. She reviewed the 24 hour page from 2013.
The Member admits that she failed to follow proper procedures to access the records, as she was not part of [Patient I]’s healthcare team. The Member admits that she did not have a clinical purpose or proper authorization to access [Patient I]’s personal health information.
[Patient J] is the Member’s [family member]. The Member accessed her records on three occasions in 2014 and 2015, as follows:
a. February 26, 2014, at 2001 hours for four minutes, the Member reviewed the 24 Hour and Imaging pages from 2013;
b. February 22, 2015, at 2027 hours for two minutes, the Member reviewed the Imaging, Other Reports and Summary pages from 2007 to 2013; and
c. February 25, 2015 at 2028 hours for two minutes, the Member reviewed the 24 Hour and Imaging pages from the year 2014.
The Member admits that she failed to follow proper procedures to access the records, as she was not part of [Patient J]’s healthcare team. The Member admits that she did not have a clinical purpose or proper authorization to access [Patient J]’s personal health information.
[Patient G] is the Member herself. The Member was never a patient of Matthews Memorial. She accessed the Imaging and Summary pages in her own chart, from 2009, on December 7, 2015 at 2046 hours. Again, the Member did not follow the appropriate process or file the required consent forms for a patient to access her own records. The Member acknowledges that she abused her position as a nurse to make the accesses without filing a written consent as required.
Improper Accesses to Other Patients’ Records
[Patient C]’s [child] was a patient at Mathews Memorial on November 27, 2015 at 2221 hours. Because Richards Landing is a small community, the Member was aware that [Patient C] was [the child’s parent], although she did not know [Patient C] personally. [Patient C]'s [child] was transported to Matthews Memorial by ambulance. Emergency Medical Services had contacted Mathews Memorial to report that an ambulance had been dispatched from the address of [Patient C]’s [child], and the patient was [ ]. The Member accessed [Patient C]’s chart on November 27, 2015, at 2141 hours, prior to [Patient C’s] [child’s] arrival, viewing the summary page.
If the Member were to testify, she would state that she was concerned about the patient’s condition, and accessed [Patient C]’s chart to obtain [their] contact information. However, [Patient C]’s [child] was able to provide [their] own medical history and it was entirely inappropriate for the Member to use another patient’s record in order to obtain next of kin information. Accordingly, the Member acknowledges that there was no clinical purpose or proper authorization to access [Patient C’]s medical records.
There is no known relationship between the Member and [Patient K]. [Patient K] presented at Matthews Memorial on February 21, 2015 at 0451 hours and was then discharged for a surgical consult at 0905 hours. Several days later, the Member accessed his chart, on February 26, 2015 at 0129 hours for two minutes, and reviewed the 24 hour page, Other Reports, and Notes pages.
The Member acknowledges that she did not have any authorization or proper clinical purpose to access [Patient K]’s personal health information five days after the patient was discharged.
[Patient L] is a [staff member] at Matthews Memorial. [Patient L] presented as a patient on November 1, 2014 with a possible [ ]. Diagnostic testing was ordered, and the results were received on November 4, 2014. The Member accessed [Patient L]’s chart on November 6, 2014, five days after [their] admission and two days after the receipt of [ ] lab results.
The Member admits that she did not have clinical purpose or proper authorization to access [Patient L]’s personal health information on November 6, 2014.
[Patient N] has no known relationship with the Member. He presented at Matthew’s Memorial on May 25, 2015 with decreased consciousness. The Member accessed his chart on July 1, 2015 at 1949 hours, and accessed Other Reports and Summary Pages. The Member again accessed [Patient N]’s chart on July 6, 2015 at 2003 hours.
The Member stated that she was making the accesses to determine whether EEG results were available so that they could be added to the file; however, the Member was not part of the healthcare team for this patient. The Member admits that she did not have clinical purpose or proper authorization to access [Patient N]’s personal health information.
[Patient O] has no known relationship with the Member. He presented at Matthews Memorial on various occasions in December of 2014 and November of 2015. The Member accessed his chart on July 15, 2015 at 0740 hours and reviewed the Summary and Imaging pages. The Member again accessed the chart on August 18, 2015, at 0005 hours, and viewed the Summary page.
The Member admits that she did not have clinical purpose or proper authorization to access [Patient O]’s personal health information months after his last admission, and months before his next admission.
Impersonation of [Patient J], the Member’s [family member]
In April 2016, SAH sent out notification letters to all patients whose records were inappropriately accessed, including the Member’s [family member], [Patient J].
Following receipt of the letter, on May 13, 2016, the Member left a voicemail message at the SAH impersonating [Patient J]. In an effort to excuse the Member’s conduct in accessing [Patient J]’s records improperly, the Member posed as [Patient J] and said that she had given [the Member] authorization to access [Patient J]’s chart.
SAH forwarded the voicemail recording to the Member’s manager. The Member’s manager recognized the Member’s voice on the recording.
During a subsequent investigation, the Member denied that it was her voice on the recording of the voicemail message. The employer retained [ ] a Professor in Linguistics at the University of Toronto, to analyse whether the voice on the recording was that of the Member or [Patient J].
[The Professor] concluded that the voicemail matched the Member's voice. The Member admitted that she was the person who left the voicemail only after this expert evidence was obtained.
The Member admits that she identified herself as [Patient J], and intentionally denied impersonating [Patient J] during the employer’s subsequent investigation when she had in fact done so.
ADMISSIONS OF PROFESSIONAL MISCONDUCT
The Member admits that she committed the acts of professional misconduct as alleged in paragraph 1 of the Notice of Hearing, in relation to the following patients: [Patient D], [Patient B], [Patient C], [Patient G], [Patient H], [Patient I], [Patient J], [Patient K], [Patient L], [Patient N], and [Patient O] (collectively, the “Patients”).
The Member admits that by improperly accessing personal health information about the Patients, she contravened BDRHC’s policies, CNO’s Confidentiality and Privacy – Personal Health Information Practice Standard, and her obligations under the Personal Health Information Protection Act, 2004.
The Member further admits that her conduct in accessing personal health information without clinical purpose or proper authorization, as alleged in paragraph 3(a) of the Notice of Hearing, in relation to the Patients, is relevant to the practice of nursing and would reasonably be regarded by members as dishonourable and unprofessional. The conduct not only violated the professional standards required of nurses, the Member knew or ought to have known that it was wrong and would bring shame on the profession.
The Member admits that she committed an act of professional misconduct when she impersonated [Patient J] on May 13, 2016, in connection with the Member’s access to [Patient J]’s personal health information without consent or proper authorization, as alleged in paragraph 4 of the Notice of Hearing. The Member further admits that her conduct is relevant to the practice of nursing and would reasonably be regarded by members as disgraceful, dishonourable and unprofessional. The conduct not only violated the professional standards required of nurses, the Member knew or ought to have known that it was wrong, and would bring disgrace upon the profession.
With leave of the Discipline Committee, CNO withdraws the following allegations in the Notice of Hearing:
a. Paragraph 1 of the Notice of Hearing in relation to [Patient A], [Patient E], [Patient F], and [Patient M];
b. Paragraph 2;
c. Paragraph 3 in relation to in relation to [Patient A], [Patient E], [Patient F], and [Patient M]; and
d. Paragraph 3(b).
Decision
The College bears the onus of proving the allegations in the Notice of Hearing in accordance with the standard of proof, that being the balance of probabilities based upon clear, cogent and convincing evidence.
Having considered the evidence and the onus and standard of proof, the Panel finds that the Member committed acts of professional misconduct as alleged in paragraph 1 of the Notice of Hearing. With respect to Allegation #3(a), the Panel finds that the conduct was both dishonourable and unprofessional. As to Allegation #4, the Panel finds that the Member engaged in conduct that would reasonably be considered by members to be disgraceful, dishonourable and unprofessional.
Reasons for Decision
The Panel considered the Agreed Statement of Facts and the Member’s plea and finds that this evidence supports findings of professional misconduct as alleged in the Notice of Hearing.
Allegation #1 in the Notice of Hearing is supported by paragraphs 21 to 44, 51 and 52 in the Agreed Statement of Facts. The Member admits accessing personal health information, without consent or other proper authorization, for patients for whom she was not a member of the health care team or in the circle of care at the time of the accesses, on or about the dates referenced to in the Agreed Statement of Facts. The Member accessed records of family members and other clients, without following the appropriate process or filing the required consent forms for patients or their family members to access the records. The Member admitted that she failed to follow proper procedures to access the records and she did not have a clinical purpose or proper authorization to access personal health information of 11 clients. The Member admits that by improperly accessing personal health information about the clients, she contravened BRDHC’s policies, CNO’s Confidentiality and Privacy – Personal Health Information Practice Standard, and her obligations under the Personal Health Information Protection Act, 2004.
Allegation #3 (a) in the Notice of Hearing is supported by paragraphs 21 to 44 and 51 to 53 in the Agreed Statement of Facts. The Member admits that as a result of electronic audits it was revealed she had reviewed the personal health information of her family members, the spouse of a former co-worker and clients who were not in her care. The Member acknowledged that she abused her position as a nurse by making the accesses without following the proper procedure or filing written consent as required. This conduct is both dishonourable and unprofessional.
The Panel finds that the Member’s conduct was unprofessional when she accessed the personal health information of 11 clients without consent or proper authorization. Nurses are accountable for practicing in accordance with the Professional Standards, practice regulations, legislation and regulations. The Member’s behaviour and actions are dishonest as she breached the clients’ right to confidentiality and privacy. Nurses have ethical and legal responsibilities to maintain confidentiality and privacy of all clients, nurses must respect this right.
The Panel also finds that the Member’s conduct was dishonourable. It demonstrated an element of dishonesty and deceit when she knowingly violated her employer’s multiple policies by accessing health information of clients without consent or authorization between 2013 and 2015. The Member deliberately breached the Professional and Practice Standards under the CNO and the Personal Health Information Protection Act,2004 (“PHIPA”) which is the standard in the nursing profession. The Member’s dishonourable conduct has an element of moral failing; the Member ought to have known that her conduct is unacceptable and falls well below the standards of the profession.
Allegation #4, in the Notice of Hearing is supported by paragraphs 45 to 50, 52 and 54 in the Agreed Statement of Facts. The Panel finds that the Member’s conduct was disgraceful, dishonourable and unprofessional as it demonstrated a serious and persistent disregard for her professional obligations. Following receipt of a letter, sent to [Patient J] on May 13, 2016 the Member left a voicemail message at the SAH impersonating [Patient J] in an effort to excuse the Member’s conduct in accessing [Patient J]’s records improperly. The Member posed as [Patient J], and said that she had given [the Member] authorization to access [Patient J’s] chart. The Member’s manager recognized the Member’s voice on the recording. The Member admitted that she was the person who left the voicemail only after expert voice analysis evidence was obtained. The Member admitted that she identified herself as [Patient J], and intentionally denied impersonating [Patient J] during the employer’s subsequent investigation. The Member admits that she committed an act of professional misconduct when she impersonated [Patient J] in connection with the Member’s access to [Patient J]’s personal health information without consent or proper authorization. The Member admitted that her conduct is relevant to the practice of nursing and would reasonably be regarded by members as disgraceful, dishonourable and unprofessional. The Member’s conduct violated the professional standards required of nurses which the Member knew or ought to have known was wrong and would bring disgrace to herself and the profession. This behaviour casts serious doubt about the Member’s moral fitness and inherent ability to discharge the higher obligations the public expects professionals to meet.
Penalty
College Counsel and the Member’s Counsel advised the Panel that a Joint Submission on Order had been agreed upon. The Joint Submission on Order requests that this Panel make an order as follows:
Requiring the Member to appear before the Panel to be reprimanded within three months of the date that this Order becomes final.
Directing the Executive Director to suspend the Member’s certificate of registration for 3 months. This suspension shall take effect from the date that this Order becomes final and shall continue to run without interruption as long as the Member remains in the practising class.
Directing the Executive Director to impose the following terms, conditions and limitations on the Member’s certificate of registration:
a) The Member will attend 2 meetings with a Regulatory Expert (the “Expert”), at her own expense and within 6 months from the date that this Order becomes final. To comply, the Member is required to ensure that:
i. The Expert has expertise in Nursing Regulation and has been approved by the Director of Professional Conduct (the “Director”) in advance of the meetings;
ii. At least seven days before the first meeting, the Member provides the Expert with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
if available, a copy of the Panel’s Decision and Reasons;
iii. Before the first meeting, the Member reviews the following CNO publications and completes the associated Reflective Questionnaires, online learning modules, decision tools and online participation forms (where applicable):
Professional Standards,
Confidentiality and Privacy - Personal Health Information, and
Code of Conduct;
iv. Before the first meeting, the Member reviews Circle of Care: Sharing Personal Health Information for Health-Care Purposes, as released by the Information and Privacy Commissioner of Ontario;
v. At least seven days before the first meeting, the Member provides the Expert with a copy of the completed Reflective Questionnaires, and online participation forms;
vi. The subject of the sessions with the Expert will include:
the acts or omissions for which the Member was found to have committed professional misconduct,
the potential consequences of the misconduct to the Member’s clients, colleagues, profession and self,
strategies for preventing the misconduct from recurring,
the publications, questionnaires and modules set out above, and
the development of a learning plan in collaboration with the Expert;
vii. Within 30 days after the Member has completed the last session, the Member will confirm that the Expert forwards his/her report to the Director, in which the Expert will confirm:
the dates the Member attended the sessions,
that the Expert received the required documents from the Member,
that the Expert reviewed the required documents and subjects with the Member, and
the Expert’s assessment of the Member’s insight into her behaviour;
viii. If the Member does not comply with any one or more of the requirements above, the Expert may cancel any session scheduled, even if that results in the Member breaching a term, condition or limitation on her certificate of registration;
b) For a period of 18 months from the date the Member returns to the practice of nursing, the Member will notify her employers of the decision. To comply, the Member is required to:
i. Ensure that the Director is notified of the name, address, and telephone number of all employer(s) within 14 days of commencing or resuming employment in any nursing position;
ii. Provide her employer(s) with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
a copy of the Panel’s Decision and Reasons, once available;
iii. Ensure that within 14 days of the commencement or resumption of the Member’s employment in any nursing position, the employer(s) forward(s) a report to the Director, in which it will confirm:
that they received a copy of the required documents, and
that they agree to notify the Director immediately upon receipt of any information that the Member has breached the standards of practice of the profession;
c) For a period of 12 months from the date the Member returns to the practice of nursing, the Member will only practice nursing for an employer or employers who agree to provide a report to the Director within 14 days of the commencement or resumption of the Member’s employment in any nursing position, confirming that they agree to perform 3 random spot audits, without warning to the Member, of the Member’s accesses to patients’ electronic health records at the following intervals and provide a report to the Director advising whether the Member has accessed personal health information without clinical purpose or proper authorization:
the first audit shall take place 3 months after the date the Member begins or resumes employment with the employer, and
the second and third audits shall take place with a period of at least 3 months between each audit.
All documents delivered by the Member to CNO, the Expert or the employer(s) will be delivered by verifiable method, the proof of which the Member will retain.
Penalty Submissions
Submissions were made by College Counsel.
The mitigating factors in this case were:
The Member has been a long-standing member of the College since 1989, a total of 30 years;
The Member has not had any previous discipline history with the College;
The Member admitted the misconduct by entering a plea;
The Member accepted responsibility for her actions;
The Member agreed to the facts outlined in the Agreed Statement of Facts;
The Member entered into a Joint Submission on Order with the College;
The Member co-operated with the College which saved time and money by avoiding a lengthy hearing;
The Member attended the hearing.
The aggravating factors in this case were:
The Member’s actions were not an isolated case;
The Member accessed 11 client(s) health records with 23 occurrences over an extended period of time;
The Member breached the policies of her employer and the Standards of Practice of the CNO and the PHIPA;
The Member accessed charts of clients months or years after the clients had been discharged;
The Member was dishonest with her employer when she denied she called SAH and impersonated [Patient J].
The proposed penalty addresses the interest of the public and the profession. The order shows that the nursing profession is capable of governing itself and protecting the public interest.
The proposed penalty provides for general deterrence through the oral reprimand sending a clear message to the profession as a whole that unauthorized access to personal health information is a serious breach that will not be tolerated.
The proposed penalty provides for specific deterrence through the 3-month suspension, the 2 meetings with a Regulatory Expert at the Member’s expense, 18-month employer notification and 3 random spot audits. All of these measures should deter the Member from future professional misconduct. It sends a strong message to the profession that breaches of clients’ personal health information will not be tolerated.
The proposed penalty provides for remediation and rehabilitation through the meetings with the Regulatory Expert, and will provide the Member with the opportunity to improve her practise by re-education in the areas of professional standards and specifications in the standard of Confidentiality and Privacy-Personal Health information and Code of Conduct. The meeting with the Regulatory Expert also allows the Member time to reflect on her errors in judgement and learn from her experience.
Overall, the public is protected because all aspects of the penalty address the most critical issue of public protection and the penalty sends a powerful message to the public that this behaviour is not acceptable and will not be tolerated by the profession. The Member will have an opportunity to reflect on her conduct, gain insight into her actions and improve her practice. Nurses have legal and ethical obligations to maintain the confidentiality and privacy of their clients’ health information. The nurse-client relationship is built on trust, respect and the client‘s rights to confidentiality and privacy. Trust and respect are a cornerstone of the nurse-client relationship.
College Counsel submitted cases to the Panel to demonstrate that the proposed penalty fell within the penalty range of similar cases before this Discipline Committee.
CNO v. Trudel (April 6, 2018) This case is similar as the member had accessed the charts of 63 clients that were not in her circle of care. This member accessed charts of family, co-workers and neighbours. This member conducted multiple breaches and she accessed lab results, x-rays and a mammogram. The penalty is similar to the present case in that the member was ordered to have an oral reprimand, a 4-month suspension, two meetings with a Regulatory Expert and 12-month employer notification.
CNO v. Vaughan (June 22, 2017) This case is similar in that the member accessed 10 client charts over 11 different dates, some clients she knew and some clients she did not know. The penalty is similar to the present case in that she was given an oral reprimand, a 3-month suspension, 2 meetings with the Regulatory Expert and 12-month employer notification.
CNO v. Edgerton (April 27, 2019) This case is similar in that the member accessed 300 client charts over a 2 year period without consent or authorization. This member accessed information on her nursing students. The penalty is similar to the present case in that the member was ordered to undergo an oral reprimand, a 4-month suspension, 3 meetings with a Regulatory Expert and 18-month employer notification.
CNO v. Holmgren (May 17, 2013) This case is vastly different from the Evoy case. The member impersonated employment references on the phone and gave false and misleading statements to potential employers. In addition, this member had multiple criminal charges. The only similarity is that of impersonation. The penalty is only similar in that the member was given an oral reprimand. This member’s certificate of registration was revoked.
The Member’s Counsel indicated that she agreed with College Counsel’s submissions.
Independent Legal Counsel (“ILC”) stated “the primary goals of an order are to ensure the protection of the public and to maintain confidence in nursing and self-regulation of the profession.” ILC referenced the Joint Submission on Order and informed the Panel that it must accept the Joint Submission on Order unless it decides that the proposed penalty was so disproportionate to the offence that to accept it would not be in the public’s interest or would bring the administration of justice into disrepute. ILC stated “experienced counsel negotiated this penalty, and it is reasonable.”
Penalty Decision
The Panel accepts the Joint Submission on Order and accordingly orders:
The Member is required to appear before the Panel to be reprimanded within three months of the date that this Order becomes final.
The Executive Director is directed to suspend the Member’s certificate of registration for 3 months. This suspension shall take effect from the date that this Order becomes final and shall continue to run without interruption as long as the Member remains in the practising class.
The Executive Director is directed to impose the following terms, conditions and limitations on the Member’s certificate of registration:
a) The Member will attend 2 meetings with a Regulatory Expert (the “Expert”), at her own expense and within 6 months from the date that this Order becomes final. To comply, the Member is required to ensure that:
i. The Expert has expertise in Nursing Regulation and has been approved by the Director of Professional Conduct (the “Director”) in advance of the meetings;
ii. At least seven days before the first meeting, the Member provides the Expert with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
if available, a copy of the Panel’s Decision and Reasons;
iii. Before the first meeting, the Member reviews the following CNO publications and completes the associated Reflective Questionnaires, online learning modules, decision tools and online participation forms (where applicable):
Professional Standards,
Confidentiality and Privacy - Personal Health Information, and
Code of Conduct;
iv. Before the first meeting, the Member reviews Circle of Care: Sharing Personal Health Information for Health-Care Purposes, as released by the Information and Privacy Commissioner of Ontario;
v. At least seven days before the first meeting, the Member provides the Expert with a copy of the completed Reflective Questionnaires, and online participation forms;
vi. The subject of the sessions with the Expert will include:
the acts or omissions for which the Member was found to have committed professional misconduct,
the potential consequences of the misconduct to the Member’s clients, colleagues, profession and self,
strategies for preventing the misconduct from recurring,
the publications, questionnaires and modules set out above, and
the development of a learning plan in collaboration with the Expert;
vii. Within 30 days after the Member has completed the last session, the Member will confirm that the Expert forwards his/her report to the Director, in which the Expert will confirm:
the dates the Member attended the sessions,
that the Expert received the required documents from the Member,
that the Expert reviewed the required documents and subjects with the Member, and
the Expert’s assessment of the Member’s insight into her behaviour;
viii. If the Member does not comply with any one or more of the requirements above, the Expert may cancel any session scheduled, even if that results in the Member breaching a term, condition or limitation on her certificate of registration;
b) For a period of 18 months from the date the Member returns to the practice of nursing, the Member will notify her employers of the decision. To comply, the Member is required to:
i. Ensure that the Director is notified of the name, address, and telephone number of all employer(s) within 14 days of commencing or resuming employment in any nursing position;
ii. Provide her employer(s) with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
a copy of the Panel’s Decision and Reasons, once available;
iii. Ensure that within 14 days of the commencement or resumption of the Member’s employment in any nursing position, the employer(s) forward(s) a report to the Director, in which it will confirm:
that they received a copy of the required documents, and
that they agree to notify the Director immediately upon receipt of any information that the Member has breached the standards of practice of the profession;
c) For a period of 12 months from the date the Member returns to the practice of nursing, the Member will only practice nursing for an employer or employers who agree to provide a report to the Director within 14 days of the commencement or resumption of the Member’s employment in any nursing position, confirming that they agree to perform 3 random spot audits, without warning to the Member, of the Member’s accesses to patients’ electronic health records at the following intervals and provide a report to the Director advising whether the Member has accessed personal health information without clinical purpose or proper authorization:
the first audit shall take place 3 months after the date the Member begins or resumes employment with the employer, and
the second and third audits shall take place with a period of at least 3 months between each audit.
All documents delivered by the Member to CNO, the Expert or the employer(s) will be delivered by verifiable method, the proof of which the Member will retain.
Reasons for Penalty Decision
The Panel understands that the penalty ordered should protect the public and enhance public confidence in the ability of the College to regulate nurses. This is achieved through a penalty that addresses specific deterrence, general deterrence and, where appropriate, rehabilitation and remediation. The Panel also considered the penalty in light of the principle that joint submissions should not be interfered with lightly.
The Panel concluded that the proposed penalty is reasonable and in the public interest. The Member has cooperated with the College and, by agreeing to the facts and a proposed penalty, has accepted responsibility. The Panel finds that the penalty satisfies the principles of specific and general deterrence, rehabilitation and remediation, and public protection. It sends a strong message to the membership regarding the importance of maintaining professional boundaries and ensuring that medical records remain private, confidential and secure. The College and the public will not tolerate any nurse who impersonates another individual, deceiving others, so they will gain some advantage. Conduct by nurses that demonstrates a lack of integrity, dishonesty, abuse of power and authority, or disregard for the welfare and safety of the members of the public is conduct that cannot be tolerated by the nursing profession.
I, Dawn Cutler, RN, sign this decision and reasons for the decision as Chairperson of this Discipline panel and on behalf of the members of the Discipline panel.