Privacy commissioner recommends SHA phase out fax machines

Saskatchewan’s privacy commissioner had to deal with almost two dozen breaches of private health information last year related to fax machines or their electronic systems – and those are only the ones voluntarily reported.

Many of the incidents involved either the wrong number being put in, but more often it was the wrong doctor’s name being selected in a menu.

This is a problem commissioner Ronald Kruzeniski has been dealing with for more than a decade.

In a report released Feb. 2, he references other reports he’d written about the same problem in 2014, 2017 and 2018 and all the way back in 2010 when his office issued a report about systemic issues with faxing personal health information.

Kruzeniski is once again recommending that the Saskatchewan Health Authority phase out the use of traditional fax machines. However, he also said it’s not just a problem with those machines; more sophisticated equipment could amplify the errors. Kruzeniski wrote the root cause is human error.

“Prior to the coronavirus disease of 2019 (COVID-19) pandemic, health-care workers already contended with high volumes of work which inevitably leads to human error. The pandemic has only increased the challenges faced by health-care workers. Human error will always exist. However, as we have witnessed, technology continues to evolve,” read the report.

He said technology needs to be used to help minimize errors.

“Systems that rely on its users to be on their best and most alert behaviour at all times will fail. We must design systems to help its users to minimize errors and achieve the intended outcomes. In the context of this Investigation Report, the intended outcome is for faxes to be sent to the intended recipients,” wrote Kruzeniski.

The commissioner’s overarching recommendations include eliminating the use of fax machines within the SHA. He also recommended disabling features that automatically suggest a recipient, which he’d also recommended in 2014.

The next recommendation was for trustees of health information to design an electronic system that reduces data entry errors, like prompting someone to confirm when they choose a recipient or make a change.

Kruzeniski is also recommending mandatory privacy impact assessment to identify privacy risks so trustees can design and implement solutions to mitigate those risks and making privacy breach reporting mandatory in Saskatchewan – which it currently isn’t.

“I recommend that the Minister of Health amend HIPA to require trustees to notify my office of a theft, loss, or unauthorized use or disclosure of personal health information,” wrote Kruzeniski.
When asked about the report, the health authority issued a statement saying it’s reviewing it and will report back to the commissioner on its progress.

“The SHA works with managers, staff and physicians to minimize such privacy breaches. SHA team members receive privacy training and regular reminders to ensure personal health information is used and disclosed appropriately,” read the statement.

The authority also said it’s moving away from the use of fax machines by using “improved electronic workflows to send health information.” But it didn’t explain where it’s at in that plan given that the SHA said in response to a 2018 report that it would comply with recommendations, including one to eliminate the faxing of personal health information.

eHealth also responded to requests on the report, explaining the health system is working on a “digital health strategy” to identify challenges and opportunities and better meet patient and provider needs.

It said it has an electronic health record view that allows health-care providers to access patients’ information regardless of where the patient goes for care and is working on the flow of information to that viewer.