In Alberta, Ms. Franc, a practicum student at the Smith Medical Clinic, was charged pursuant to contravening section 107 of the Health Information Act (RSA 2000, c. H-5). Ms. Franc pleaded guilty to the three counts of violating the HIA and the Alberta Court issued its decision about the penalty.
The background is straightforward. Ms. Franc was a practicum student at the Smith Medical Clinic, seeking to pursue a career as a medical office assistant. As part of her employment, she was required to sign a confidentiality agreement confirming her obligation to maintain the confidentiality of all patient information. All client information was stored on the clinic’s Electronic Medical Record (EMR) system. Despite knowing that she was only permitted to access records in connection with her work duties, she accessed medical records of two people. The first, known as M.M., was in a romantic relationship with Ms. Franc at some point in the past. The second, identified as S.T.C., had been a romantic relationship with M. M. both before and after his relationship with Ms. Franc.
Sometime after M.M. and S.T.C. resumed a romantic relationship, Ms. Franc expressed her desire to break up their relationship to friends. Over a period of approximately eight months, she accessed M.M.’s health records 11 times. During a seven-month period, she also accessed S.T.C.’s information 27 times. Of particular significance, Ms. Franc took a photograph of some of S.T.C.’s information and sent it to a friend. She then revealed S.T.C.’s health information to M.M in hopes of ending the relationship. When she found out that S.T.C. was scheduled to attend the clinic, the Defendant disclosed the purpose of the medical test to a friend and reported that she planned to be “passive aggressive to the max” toward S.T.C. during her appointment.
Upon learning of the improper access, the clinic conducted an investigation and ultimately terminated Ms. Franc. Ms. Franc was subsequently charged as a result of incident for contravening the Health Information Act. The Crown submitted that the sentence should include a $15,000.00 fine; three years probation; and, 240 hours of community service. In support of this position, the Crown argued that there was an egregious breach of the privacy rights of the involved individuals. In contrast, the defence argued that the penalty should include a $6,000.00 fine and 150 hours community service.
In deciding the appropriate penalty, the Court found that the proportionate sentence must reflect the gravity of the offences; and, the high moral culpability of Ms. Franc’s actions. Aggravating factors included the fact that (1) she had accessed the records through her employment in violation of the confidentiality agreement; (2) the records had been accessed on multiple occasions over an extended period of time in a planned and deliberate fashion that only stopped when she was caught; (3) the actions were motivated by malice and the personal desire to end a romantic relationship; and, (4) some of the health information was photographed and shared with a third party. The mitigating factors included the guilty plea early in the prosecution (which indicated remorse and acceptance of responsibility). It also included the fact that she had secured employment at a hospital even though the charges had been disclosed which indicated that the prospects for rehabilitation were good. Finally, the Court took into consideration the fact that Ms. Franc was young and had a small child.
The Court ordered that Ms. Franc pay a $6,000.00 fine combined with a three-year probation that included 180 hours of community service.
It is important to note that the charges that were brought against Ms. Franc were quasi-criminal in nature. In other words, the charges did not stem from the Criminal Code of Canada; rather, they stemmed from the “offences and penalties” section of the Health Information Act, which sets a maximum fine of $50,000.00 (with certain caveats). Similar legislation exists in the Ontario, the Personal Health Information Protection Act (“PHIPA”), which also includes an offences section specifying the penalty for contravening a portion of the Act. The penalty in Ontario is higher than that of its counter-part in Alberta; namely, the maximum penalty for an individual is $200,000.00 and a penalty for “not a natural person” (i.e. a clinic) is $1,000,000.00. However, as seen in Ms. Franc’s case, the actual penalty will depend on various aggravating and mitigating factors that will be considered by a judge.
Notably, there have not been any cases in Ontario where the Court has ordered a fine against an individual or an institution. Considering the recent Alberta decision, this may change soon.
See R v Franc, 2020 ABPC 156 (CanLII)
