The first person ever charged under Ontario’s health privacy law committed professional misconduct by snooping into the personal health records of 5,800 patients over six years, the College of Nurses of Ontario has ruled.

North Bay nurse Melissa McLellan was charged under the 2004 Personal Health Information Protection Act (PHIPA) in relation to the massive privacy breach, but her case was dismissed in January 2015 due to delay by Crown prosecutors.

In early April, 51-year-old McLellan appeared before a disciplinary panel of her regulatory professional body. As a result of the misconduct finding, she has lost her licence as a nurse for four months and receives a formal reprimand.

McLellan could not immediately be reached for comment by the Star. She admitted to professional misconduct at the hearing.

According to the College of Nurses of Ontario’s agreed upon statement of facts, submitted during the hearing, McLellan was fired in May 2011 from the hospital she had worked at since November 1999.

The name of the hospital is censored in this document, but McLellan filed a grievance against North Bay (Regional) Health Centre for letting her go and that arbitrator’s ruling is publicly available.

She also appeared on Ontario’s Sunshine List for 2008-2010, making slightly over $100,000 a year as a registered nurse at North Bay General Hospital, which merged with North East Mental Health Centre in 2011 to become the North Bay Regional Health Centre.

In the agreed upon statement of facts, McLellan acknowledges “it was her practice between 2005 and 2011, to routinely access electronic client records for clients who were not under her care.”

McLellan “was curious” about the medical conditions and treatments of different patients and saw looking at the records as part of “self-education,” and “as a means of keeping current,” the document states.

There was no evidence that she shared the information with anyone, it reads, adding the results of an audit on her access of electronic health records indicated the hospital “did not have an effective system of monitoring access to electronic health records.”

McLellan and the hospital are the subject of a class-action suit brought by some patients, the document notes.

A spokesperson for the North Bay Regional Health Centre, Lindsay Smylie Smith, wrote in an emailed statement to the Star that the hospital provides all staff with privacy orientation and training and has them sign a confidentiality agreement.

“The hospital has taken corrective action to prevent reoccurrence by any other staff who many have been identified through the investigation process,” she wrote, adding the existing process for auditing access to electronic records was reviewed and “a more rigorous audit tool” was introduced in 2012.

The arbitrator who dismissed McLellan’s grievance against the hospital for letting her go called the privacy breach “truly breathtaking” and “almost mind-boggling.” It included some “extraordinarily personal” information, such as diagnoses of depression and past suicide risks.

But there was no evidence to suggest that McLellan ever shared the information with anyone or misused it in any way, the arbitrator noted, finding her to be a “credible, decent person caught up in a maelstrom of reaction.”

Reached by phone, a man who identified himself as her ex-husband, Mark McLellan, said she never looked at the records “for ulterior motives” and it was “more just curiosity.”

Privacy lawyer Michael Crystal said the College of Nurses of Ontario’s decision, along with its April finding on Peterborough nurse Mandy Edgerton, should act as a “green light” for the Ministry of the Attorney General to prosecute privacy breaches.

Loading... Loading... Loading... Loading... Loading... Loading...

“These college decisions send out a clear signal that this conduct is reprehensible and will be treated seriously,” he said.

The College of Nurses of Ontario’s disciplinary panel recently found Edgerton had committed professional misconduct by looking at nearly 300 patient records at a Peterborough hospital over two years.

Edgerton was not charged under PHIPA. Like McLellan, she faces a four-month suspension and reprimand from her professional regulatory body.

Star investigations have shed light on the rising number of medical-record privacy breaches and the limitations of the legislation as it stood at the time.

On May 5, Ontario passed new health privacy legislation, which increases fines for violating PHIPA, eliminates the six-month time limit to start prosecution and makes it mandatory to report privacy breaches to the Information and Privacy Commissioner and regulatory colleges where relevant.

Although McLellan was the first person ever charged under PHIPA, there have now been two convictions.

Mohammad Rahman of Toronto, and Debbie Davison of Pickering, pleaded guilty under PHIPA in February and April 2016 respectively, in connection with looking at former mayor Rob Ford’s medical records while he was receiving treatment for cancer at Princess Margaret Cancer Centre.

Caroline Goodridge was also charged under PHIPA in relation to looking at Ford's medical records, but the charges against her were withdrawn in February 2016, when the court was advised “that there was no longer a reasonable prospect of conviction,” a spokesperson from the Ministry of Health and Long-Term care said in an email.

For Crystal, snooping into hospital files is akin to placing a hidden camera in a doctor’s office and can cause a lot of “fears and anxieties” especially among people in smaller communities.

“People feel when they go to a hospital their most intimate details about their personal health are being vigorously protected,” he said.

With files from Olivia Carville