Dozens of health care workers caught ‘snooping’ into medical records of Lapu-Lapu Day victims: report

Three dozen health-care professionals were caught “spying” on patients’ medical records after the Lapu-Lapu Day tragedy in Vancouver last year, according to a new report from B.C.’s Information and Privacy Commissioner.

Discipline includes suspension and termination in accordance with report Released on Wednesday from the Office of the Information and Privacy Commissioner (OIPC).

Lapu-Lapu Day celebrations in Vancouver ended tragically on April 26, 2025, when a car crash killed 11 people and injured at least 31 others.

Commissioner Michael Harvey said the report showed that spying could be detected and would be disciplined.

“This is intolerable in our health care system,” Harvey said.

His office received multiple privacy breach notifications from the Vancouver Coastal Health Authority, Fraser Health Authority, Providence Health Care and the provincial Health Services Authority.

There were 71 espionage incidents on records of 16 individuals by 36 health care workers.

“In most cases, these employees invaded the privacy of individuals to satisfy their curiosity,” the report said.

According to Harvey, health systems know that curiosity increases after a tragedy.

“For this reason, in this case health authorities took special measures to prevent espionage, special security measures, and special measures to detect and respond to it,” he said.

According to the report, health officials and Providence Health Care sent notices reminding staff about the need to respect confidentiality at high-profile incidents, suspended access to some records and added warnings to the medical records of some inpatient patients.

Espionage in health care, which the OEPC said often involves accessing medical records when the employee is not involved in a patient’s care, is “particularly serious” because of the relationship of trust between patients and health care workers.

Harvey said patients often come to hospitals and health care facilities “at their most vulnerable moments.”

“When they do that, they don’t have to worry about their personal information. They need to worry about the life-altering event that caused them to be seen in that clinical setting.”

If staff aren’t treating a patient or if they don’t need certain information for the specific purpose of benefiting a patient, they don’t have access to it, Harvey said.

“People in our health care system know this. Their training is essential,” Harvey said.

In a joint statement, the provincial health services authority, Vancouver Coastal Health, Fraser Health and Providence Health Care said the inappropriate patient privacy violations were “unacceptable and inexcusable.”

Once violations were identified, they were investigated and employees were disciplined, he said.

“We are also accelerating the implementation of a more robust audit solution with additional real-time privacy audit functions to strengthen existing security measures.”

They collectively accepted all of the OIPC’s recommendations, including updating privacy breach procedures to include information about notification requirements and disciplinary guidelines and continued efforts to use automated auditing software with a focus on real-time alerts and automated access prevention.

The provincial health services authority said 26 of its employees were found to have violated patient confidentiality and the records of the alleged perpetrator.

According to the report, the staff at all health authorities whose personal information was accessed included nurses, administrative support staff, a pharmacist and medical students.

The discipline they received ranged from a letter of expectation to dismissal, with most employees being suspended, the report said.