SARNIA, ONT.—The Information and Privacy Commissioner of Ontario is investigating after a Sarnia woman was contacted by a private cosmetic surgery clinic that offered to perform a procedure she had already booked at a public hospital.

Patricia Pede said she and her husband were stunned when someone from the Centric Health plastic surgery clinic called in March to try to convince her to move her procedure — elective surgery covered by OHIP — to the private facility. She said the clinic, which she had never contacted before, even offered a discount on a follow-up surgery.

When Pede refused the offer and asked how the clinic obtained her personal information, the woman hung up. “It was just ‘Okay, bye,’ then click,” Pede said.

Pede has “no idea” how Centric got her information and, according to a letter the company sent her, neither does Centric, a publicly traded medical company with 10,000 employees in almost 1,000 locations across Canada.

In the letter to the Sarnia woman, Centric says it wasn’t able to track down how it got Pede’s information, saying it “would have been on a referral that was faxed” to the Sarnia office. The referral may have been faxed to the company “in error” as Centric receives many faxed referrals from general practitioners in the area, the letter suggests. Whatever document they received “was shredded immediately” and no information about Pede was kept by the company, the letter added.

Gaye Sydenham, a vice-president and also the chief privacy officer of Centric, told the Star she has never heard of this happening at the company before, calling it “very unusual.”

“These things are very straight forward. We only call with a referral from a physician,” she said.

That explanation doesn’t satisfy Pede, who wonders how Centric also knew her procedure was OHIP-approved.

Ian Campbell, Pede’s doctor in Sarnia, said he is certain his office did not contact Centric. He said his referral was sent to a doctor in London, where the surgery was scheduled, and wouldn’t have referred to OHIP at all. He added that his records are kept in paper form and are not part of the Ontario electronic medical record database.

Frustrated by the lack of answers, Pede contacted the Information and Privacy Commissioner of Ontario.

In a statement to the Star, acting commissioner Brian Beamish says his office is “actively investigating this complaint of a breach in confidential information.” The statement adds that Beamish’s staff is “working with the health-information custodian and the complainant to find satisfactory resolution and ensure that the health information custodian treats all records in accordance with the provisions of the Personal Health Information Protection Act.”

Trell Huether, spokesman for the commissioner’s office, said it received 74 complaints about inappropriate use, disclosure or collection of medical information across the province last year. The office also received 184 self-reported breaches from so-called health-information custodians and initiated 23 complaints on its own last year.

No other complaints have been made against Centric to the commissioner’s office, Huether added.

Loading... Loading... Loading... Loading... Loading... Loading...

The Personal Health Information Protection Act, passed in 2004, says medical records cannot be divulged without the patient’s consent, whether under public or private health care. This includes doctors, hospitals, laboratories, and the Ministry of Health, according to a Guide to the Act, written by Ontario’s former privacy commissioner Ann Cavoukian.

If a complaint to the commissioner is not resolved informally, a formal review can take place, allowing the commissioner to demand records and documents from people involved, and summon them to testify under oath. A complainant can sue someone found to have committed an offence by the commissioner for up to $10,000.

The Ministry of Health said in a statement that it “takes seriously the protection of patient privacy” and says doctors are responsible for looking after privacy of patient information. “Health information custodians are responsible for proper use and control of records containing personal health information until the records are securely transferred to another custodian.”

The ministry does not disclose any personal health information without the consent of the individual to whom the information relates unless ordered to by an Ontario court, according to the statement.

Centric is planning to change the way it handles phone contacts in light of Pede’s complaint, Sydenham says.

The company “will investigate the feasibility” of keeping phone logs when calling someone following a doctor’s referral, including only the patient’s name, phone number and when the call was made, she said. Referrals will continue to be shredded, and the call logs will not include personal information such as the reason for the referral.