DISCIPLINE COMMITTEE OF THE COLLEGE OF NURSES OF ONTARIO
PANEL: Lalitha Poonasamy, Public Member Chairperson Tammy Hedge, RPN Member Jane Hess, RN Member Susan Roger, RN Member
BETWEEN:
COLLEGE OF NURSES OF ONTARIO ) JOSEPH BERGER for ) College of Nurses of Ontario
- and - )
LYNSEY STULL ) REBECCA YOUNG for Registration No. AF164810 ) Lynsey Stull
) PATRICIA HARPER_ ) Independent Legal Counsel
) Heard: June 24, 2024, via videoconference
DECISION AND REASONS
Publication Ban
By Order of the Discipline Panel dated June 24, 2024, pursuant to subsection s.45(3) of the Health Professions Procedural Code of the Nursing Act, 1991, no one shall publish or broadcast the name(s) of the patient(s), or any information that could disclose the identity(ies) of the patient(s), referred to orally or in any documents presented at the Discipline hearing of Lynsey Stull.
This matter was heard by a panel of the Discipline Committee (the “Panel”) of the College of Nurses of Ontario (the “College”) on June 24, 2024.
The Allegations
The allegations against Lynsey Stull (the “Member”) as stated in the Notice of Hearing dated February 6, 2024 are as follows:
IT IS ALLEGED THAT:
You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(1) of the Ontario Regulation 799/93, in that, while working as a Registered Practical Nurse at Erie Shores Family Health Team, in Leamington, Ontario, you contravened a standard of practice of the profession or failed to meet the standards of practice of the profession in that on or around July 28, 2022, you accessed the personal health information of approximately 16 patients, listed at Appendix A, without consent, authorization and/or professional purpose.
You have committed an act of professional misconduct as provided by subsection 51(1)(c) of the Health Professions Procedural Code of the Nursing Act, 1991, S.O. 1991, c. 32, as amended, and defined in subsection 1(37) of Ontario Regulation 799/93, in that, while working as a Registered Practical Nurse at Erie Shores Family Health Team, in Leamington, Ontario, you engaged in conduct or performed an act, relevant to the practice of nursing, that, having regard to all the circumstances, would reasonably be regarded by members as disgraceful, dishonourable or unprofessional in that on or around July 28, 2022, you accessed the personal health information of approximately 16 patients, listed at Appendix A, without consent, authorization and/or professional purpose.
Appendix A
Patient Initials
Time of Initial Access on July 28, 2022
[A]
15:22:28
[B]
15:23:13
[C]
15:04:11
[D]
15:06:50
[E]
15:07:09
[F]
15:07:49
[G]
15:00:50
[H]
15:02:24
[I]
14:11:46
[J]
13:51:32
[K]
13:51:46
[L]
13:47:31
[M]
13:48:52
[N]
13:49:14
[O]
13:50:13
[P]
13:51:06
Member’s Plea
The Member admitted the allegations set out in paragraphs #1 and #2 in the Notice of Hearing. The Panel received a written plea inquiry which was signed by the Member. The Panel also conducted an oral plea inquiry and was satisfied that the Member’s admissions were voluntary, informed and unequivocal.
Agreed Statement of Facts
College Counsel and the Member’s Counsel advised the Panel that agreement had been reached on the facts and introduced an Agreed Statement of Facts, which reads, unedited and without the exhibits/appendix mentioned therein, as follows:
THE MEMBER
Lynsey Stull (the “Member”) registered with the College of Nurses of Ontario (“CNO”) as a Registered Practical Nurse (“RPN”) on August 8, 2016.
The Member was employed by the Erie Shores Family Health Team in Leamington, Ontario (the “Facility”) as a part-time RPN from May 2, 2022, until her termination on August 15, 2022.
INCIDENTS RELEVANT TO ALLEGATIONS OF PROFESSIONAL MISCONDUCT
On or around August 2, 2022, the Facility received a complaint from a patient (the “complainant”) alleging that the Member had shared their personal health information with members of the community outside of the Facility. The complainant indicated that they personally knew the Member and knew that the Member worked at the Facility. Following receipt of the complaint, the Facility conducted an audit of the Member’s accesses of patients’ electronic medical records.
The Facility’s audit revealed that on July 28, 2022, the Member accessed not only the complainant’s electronic medical records, but also the complainant’s partner’s electronic medical records, and additionally, the electronic medical records of 16 other patients listed at Appendix A of this Agreed Statement of Facts, without consent, authorization or any professional purpose.
The Facility met with the Member on August 15, 2022, to discuss the results of its audit. During this meeting, the Member did not deny that on July 28, 2022 she had improperly accessed the electronic medical records of the complainant, the complainant’s partner, and the 16 patients listed at Appendix A of this Agreed Statement of Facts, without consent, authorization or any professional purpose. The Member accepted the Facility’s decision to immediately terminate her employment with cause.
The Facility was unable to verify whether the Member had provided any patients’ personal health information to any individuals in the community.
If the Member were to testify, she would deny disclosing any patients’ personal health information to any individuals in the community. The Member admits and takes full responsibility for inappropriately accessing the electronic medical records of the 16 patients listed in Appendix A of this Agreed Statement of Facts, at the times listed.
PROFESSIONAL OBLIGATION TO PROTECT PERSONAL HEALTH INFORMATION
The Member received orientation and training on privacy and personal health information from the Facility as a new hire.
Prior to commencing her employment at the Facility in May 2022, the Member signed the Facility’s “Confidentiality Agreement” which included an affirmation that she would ensure that she did not inappropriately access confidential information.
CNO STANDARDS
Code of Conduct
- CNO’s Code of Conduct is a standard of practice describing the accountabilities all Ontario nurses have to the public. The Code of Conduct consists of six principles including:
Nurses respect the dignity of patients and treat them as individuals;
Nurses work together to promote patient well-being;
Nurses maintain patients’ trust by providing safe and competent care;
Nurses work respectfully with colleagues to best meet patients’ needs;
Nurses act with integrity to maintain patients’ trust; and
Nurses maintain public confidence in the nursing profession.
CNO’s Code of Conduct provides, in relation to the principle requiring nurses to maintain patients’ trust by providing safe and competent care, that nurses are accountable to, and practice under, relevant laws and CNO’s standards of practice.
CNO’s Code of Conduct provides, in relation to the principle requiring nurses to act with integrity to maintain patients’ trust, that nurses protect the privacy and confidentiality of patients’ personal health information.
CNO’s Code of Conduct also provides, in relation to the principle requiring nurses to maintain public confidence in the nursing profession, that nurses are accountable for their own actions and decisions.
Attached as Exhibit “A” is a copy of CNO’s Code of Conduct which was in force at the time of the incidents.
Professional Standards
CNO’s Professional Standards, Revised 2002 (“Professional Standards”) provides that each nurse is accountable to the public and responsible for ensuring their practice and conduct meets legislative requirements and the standards of the profession. It also states that nurses are responsible for their actions and the consequences of those actions, and they are also accountable for conducting themselves in ways that promote respect for the profession.
CNO’s Professional Standards further provide that ethical nursing care means promoting the values of patient well-being, respecting patient choice, assuring privacy and confidentiality, respecting the sanctity and quality of life, maintaining commitments, respecting truthfulness and ensuring fairness in the use of resources. It also includes acting with integrity, honesty and professionalism in all dealings with the patient and other health care team members.
A copy of CNO’s Professional Standards, Revised 2002, in force at the relevant time, is attached as Exhibit “B”.
Confidentiality and Privacy: Personal Health Information
- CNO’s Confidentiality and Privacy - Personal Health Information standard (“Privacy Standard”) largely incorporates the Personal Health Information Protection Act, 2004. The Privacy Standard provides that nurses have ethical and legal responsibilities to maintain the confidentiality and privacy of patient health information obtained while providing care. It requires that personal health information be kept confidential and secure. Nurses comply with the Privacy Standard by:
Seeking information about issues of privacy and confidentiality of personal health information;
Maintaining confidentiality of [patients’] personal health information with members of the healthcare team, who are also required to maintain confidentiality, including information that is documented or stored electronically;
Collecting only information that is needed to provide care;
Accessing information for her/his [patients] only and not accessing information for which there is no professional purpose; and
Safeguarding the security of computerized, printed or electronically displayed or stored information against theft, loss, unauthorized access or use, disclosure, copying, modification or disposal.
A copy of CNO’s practice standard Confidentiality and Privacy: Personal Health Information, in force at the relevant time, is attached as Exhibit “C”.
The Member admits and acknowledges that accessing the personal health information of patients without consent, authorization or professional purpose was a breach of CNO’s Code of Conduct, Professional Standards and Confidentiality and Privacy: Personal Health Information standard, in force at the relevant time.
ICRC DISPOSITION OF RELATED COMPLAINT
The complainant made a complaint to CNO with respect to the Member’s improper access of their personal health information, along with that of their partner. In respect of this complaint, a panel of the College’s Inquiries, Complaints and Reports Committee (“ICRC”) made an order on April 19, 2023 (the “Order”) directing that the Member be cautioned and complete remedial activities.
Specifically, this Order required that the Member to complete a specified continuing education or remedial program (“SCERP”) with respect to the following CNO standards, and attend before the ICRC to be cautioned with respect to the following CNO standards:
Professional Standards, Revised 2002
Confidentiality and Privacy: Personal Health Information
Code of Conduct
The SCERP further required that the Member attend a meeting with an approved regulatory expert to discuss the incidents investigated, the applicable nursing standards and the insights and learnings gained from practice reflection.
The Member completed the SCERP in September 2023 and received an in-person Caution from the ICRC on December 12, 2023, completing the terms of the ICRC’s Order.
ADMISSIONS OF PROFESSIONAL MISCONDUCT
The Member admits that she committed the acts of professional misconduct as alleged in paragraph 1 of the Notice of Hearing, in that, she contravened a standard of practice of the profession or failed to meet the standards of practice of the profession as described in paragraphs 3 - 20 above.
The Member admits that she committed the acts of professional misconduct as alleged in paragraph 2 of the Notice of Hearing, and in particular her conduct was dishonourable and unprofessional, as described in paragraphs 3 - 20 above.
Submissions of College Counsel
College Counsel presented the three College standards mentioned in the Agreed Statement of Facts for the Panel’s review and described the Member’s conduct as having improperly accessed patient records. These breaches were outside the Member’s requirements to deliver care. The Member’s behaviour was beyond that of “snooping” of one patient and included access to 16 patients’ charts. College Counsel submitted that the public expects nurses to use health information for professional purposes only and the Member’s conduct is considered a marked departure from the standards and her obligations.
Submissions of the Member’s Counsel
The Member’s Counsel submitted that the Member has made a voluntary plea and acknowledged that her conduct was unprofessional and dishonourable.
Decision
The College bears the onus of proving the allegations in accordance with the standard of proof, that being the balance of probabilities based upon clear, cogent and convincing evidence.
Having considered the evidence and the onus and standard of proof, the Panel finds that the Member committed acts of professional misconduct as alleged in paragraphs #1 and #2 of the Notice of Hearing. Regarding allegation #2, the Panel finds that the Member engaged in conduct that would reasonably be regarded by members of the profession to be unprofessional and dishonourable.
Reasons for Decision
The Panel considered the Agreed Statement of Facts and the Member’s plea and finds that this evidence supports findings of professional misconduct as alleged in the Notice of Hearing.
Allegation #1 in the Notice of Hearing is supported by paragraphs 3 to 20 and 25 in the Agreed Statement of Facts. The Member admitted that while working as a Registered Practical Nurse (“RPN”) at Erie Shores Family Health Team (the “Facility”) her conduct breached the College’s Code of Conduct, the Professional Standards and the Confidentiality and Privacy - Personal Health Information Standard (“Privacy Standard”), in force at the time when she accessed the personal health information of approximately 16 patients without consent, authorization or professional purpose.
The College’s Code of Conduct specifies that nurses must act with integrity to maintain patients’ trust and protect the privacy and confidentiality of patients’ personal health information. Further, the Professional Standards provides that ethical nursing care includes ensuring the privacy and confidentiality of patients’ personal health information. The Member acknowledged that she had accessed 16 patients’ medical records without clinical need and therefore had breached these standards.
The Panel determined that the Member also breached the College’s Privacy Standard in accessing patient information for which she had no professional purpose by disregarding her legal and ethical responsibility to maintain the confidentiality and privacy of these patients.
Allegation #2 in the Notice of Hearing is supported by paragraphs 3 to 20 and 26 in the Agreed Statement of Facts. The Panel finds that the Member’s conduct showed a lack of respect for patients’ privacy in that she accessed these charts without professional purpose or the patients’ consent. Her conduct was unprofessional as it demonstrated a serious and persistent disregard for her professional obligations in breaching the Code of Conduct, the Professional Standards and the Privacy Standard.
The Panel also finds that the Member’s conduct was dishonourable. It demonstrated an element of deceit and moral failing by accessing patient records without a clinical purpose. Her conduct occurred over a single day without any professional necessity. The public entrusts nurses with their personal health information and the Member had an obligation to only use that information in the delivery of health or personal care. The Member knew or ought to have known that her conduct was unacceptable and fell well below the standards of a professional.
Penalty
College Counsel and the Member’s Counsel advised that a Joint Submission on Order had been agreed upon and requested that the Panel make the following order:
Requiring the Member to appear before the Panel to be reprimanded within 3 months of the date that this Order becomes final.
Directing the Executive Director to suspend the Member’s certificate of registration for 2 months. This suspension shall take effect from the date that this Order becomes final and shall continue to run without interruption as long as the Member remains in a practicing class.
Directing the Executive Director to impose the following terms, conditions and limitations on the Member’s certificate of registration:
a) For a period of 12 months from the date the Member returns to the practice of nursing, the Member will notify the Member’s employers of the decision and be subject to random spot audits of the Member’s accesses to electronic patient health records. To comply, the Member is required to:
i. Inform any employer of the decision prior to commencing or prior to resuming employment in any nursing position;
ii. Ensure that CNO is notified of the name, address, and telephone number of all employer(s) within 14 days of commencing or resuming employment in any nursing position;
iii. Provide the Member’s employer(s) with a copy of:
the Panel’s Order,
the Notice of Hearing,
the Agreed Statement of Facts,
this Joint Submission on Order, and
a copy of the Panel’s Decision and Reasons, once available;
iv. Only practice nursing for an employer who agrees to, and does, forward a report to CNO within 14 days of the commencement or resumption of the Member’s employment in any nursing position, confirming:
that they received a copy of the required documents,
that they agree to notify CNO immediately upon receipt of any information that the Member has breached the standards of practice of the profession, and
that they agree to perform 3 random spot audits of the Member’s electronic accesses to patient health records at the following intervals over a 12-month period and provide a report to CNO regarding the Member’s accesses after each audit:
a. the first audit shall take place within 4 months from the date the Member begins or resumes employment with the employer,
b. the second audit shall take place within 8 months from the date the Member begins or resumes employment with the employer, and
c. the third audit shall take place within 12 months from the date the Member begins or resumes employment with the employer.
- All documents delivered by the Member to CNO, or the employer(s) will be delivered by verifiable method, the proof of which the Member will retain.
College Submissions on Penalty
College Counsel made submissions on the overarching goals of penalty orders: specific deterrence, general deterrence, remediation and rehabilitation. College Counsel reminded the Panel that while no two cases are factually the same, their duty was to protect the public and deliver a penalty that served to regulate nursing as a profession.
The aggravating factor in this case was:
- The Member breached the patients’ and the Facility’s trust by accessing patient health records with no clinical purpose.
The mitigating factors were:
The Member has taken responsibility for her conduct with the Facility and the College;
The Member is remorseful and has admitted to her conduct by entering into an Agreed Statement of Facts and a Joint Submission on Order with the College; and
The Member has no disciplinary history with the College.
An additional complaint was made directly to the College and the underlying misconduct is the same. As a result of the Inquiries, Complaints and Review Committee’s assessment of this matter, they disposed of the related complaint one year ago by imposing terms on the Member’s certificate of registration. These terms, by way of a Specified Continuing Education or Remedial Program (“SCERP”), included a meeting with a Regulatory Expert and review of the relevant standards. The Member successfully completed these rehabilitative measures and the Joint Submission on Order, therefore, does not include such terms.
College Counsel submitted the following cases to the Panel to demonstrate that the proposed penalty fell within the range of similar cases from this Discipline Committee:
CNO v. Brutzki (Discipline Committee, 2016): This hearing proceeded by way of an Agreed Statement of Facts and a Joint Submission on Order. In this case, the member accessed the personal health information of 25 clients over an 11-month period. The member’s conduct was found to be dishonourable and unprofessional. The penalty included an oral reprimand, a 2-month suspension of the member’s certificate of registration, 2 meetings with a Nursing Expert, 12 months of employer notification and 2 random audits of the member’s accesses to electronic health records.
CNO v. Halley (Discipline Committee, 2018): This hearing proceeded by way of an Agreed Statement of Facts and a Joint Submission on Order. In this case, the member was found to have accessed the personal health information of one high-profile patient 13 times over a period of 7 days; was identified in multiple parts of the records; and, the depth and extent of the accesses was much more involved. The member’s conduct was found to be dishonourable and unprofessional. The penalty included an oral reprimand, a 2-month suspension of the member’s certificate of registration, 2 meetings with a Nursing Expert and 12 months of employer notification.
CNO v. Twance (Discipline Committee, 2021): This hearing proceeded by way of an Agreed Statement of Facts and a Joint Submission on Order. In this case, the member accessed the personal health information of one patient who she had a personal relationship with as the member was friends with the patient’s boyfriend. These accesses were prolonged and repeated over a 4-month period. The member’s conduct was found to be dishonourable and unprofessional. The penalty included an oral reprimand, a 2-month suspension of the member’s certificate of registration, 1 meeting with a Regulatory Expert and 12 months of employer notification.
College Counsel submitted that the penalty orders in the above noted cases were very similar and that the Panel could be confident that the penalty agreed to by the parties in the case before this Panel was reasonable and fair.
Member’s Submissions on Penalty
The Member’s Counsel indicated that she agreed with College Counsel’s submissions. The Member’s conduct had taken place over a relatively short period of time and there was no evidence of further disclosure of the personal health information being made. The Member’s Counsel submitted that the Member had cooperated with the College and took this matter seriously.
The Member’s Counsel agreed that the penalty proposed was within a reasonable range of previous orders of the Discipline Committee and that it fulfilled the goals of penalty as outlined by College Counsel.
Penalty Decision
The Panel accepted the Joint Submission on Order and made the order requested.
Reasons for Penalty Decision
There is a high threshold for departing from a Joint Submission on Order established by the Supreme Court of Canada in R. v. Anthony-Cook, 2016 SCC 43. Departing from a joint submission would require a finding that the proposed penalty would bring the administration of justice into disrepute or is otherwise contrary to the public interest.
The Panel concluded that the proposed penalty is not contrary to the public interest and does not bring the administration of justice into disrepute.
The Panel concluded that the proposed penalty is reasonable and in the public interest. It promotes public confidence in the ability of the College to regulate nurses.
The Panel finds that the proposed penalty satisfies the penalty goals of specific and general deterrence, rehabilitation and remediation, and public protection.
The proposed penalty provides for general deterrence through the 2-month suspension of the Member’s certificate of registration sending a clear message to the membership, at large, that this type of conduct and breach of the standards will not be tolerated.
The proposed penalty provides for specific deterrence through the direct impact to the Member of a 2-month suspension of the Member’s certificate of registration. The oral reprimand will assist the Member in achieving a greater understanding of how her unprofessional conduct is perceived by members of the public and the profession.
The Panel was satisfied with the Member’s successful SCERP completion and did not make an order to duplicate these remedial measures.
Overall, the public is protected through the 12 months of employer notification and the 3 random spot audits of the Member’s electronic accesses to patient health records, providing for an additional level of oversight and heightened level of monitoring on the Member’s return to ethical practice.
The Panel acknowledges that the Member has co-operated with the College and, by agreeing to the facts and a proposed penalty, has accepted responsibility, which is a mitigating factor.
The penalty is in line with the range of what has been ordered in previous similar cases as demonstrated by the cases submitted and referred to by College Counsel.
I, Lalitha Poonasamy, Public Member, sign this decision and reasons for the decision as Chairperson of this Discipline Panel and on behalf of the members of the Discipline Panel.