In the wake of the Lapu-Lapu Day tragedy in Vancouver last year, a recent report by B.C.’s information and privacy commissioner revealed that 36 health-care professionals were discovered to have inappropriately accessed the medical records of individuals who were patients at that time.
The investigation conducted by the Office of the Information and Privacy Commissioner (OIPC) found that disciplinary actions, including suspensions and terminations, were taken against those involved. The tragic incident occurred on April 26, 2025, during the Lapu-Lapu Day festival in Vancouver, resulting in the deaths of 11 people and injuries to over 31 individuals.
Commissioner Michael Harvey emphasized the importance of detecting and addressing such privacy breaches, stating that unauthorized access to medical records is unacceptable within the health-care system. Multiple privacy breach notifications were received by Harvey’s office from various health authorities, including Vancouver Coastal Health Authority, Fraser Health Authority, Providence Health Care, and the Provincial Health Services Authority.
A total of 71 instances of unauthorized access to the records of 16 individuals were identified, involving 36 health-care workers. The report highlighted that most of these employees breached individuals’ privacy out of personal curiosity. The health systems were aware of the heightened curiosity following a tragedy and implemented special measures to prevent and detect unauthorized access.
Harvey stressed the importance of maintaining patient trust in the health-care system, especially during vulnerable moments. He emphasized that access to medical records should be limited to those directly involved in patient care and for legitimate purposes only. The health authorities, along with Providence Health Care, took steps such as staff reminders, access restrictions, and enhanced monitoring to address the breaches and prevent future occurrences.
In response to the report, the health authorities acknowledged the gravity of the privacy breaches and committed to implementing stronger privacy safeguards. They accepted all recommendations from the OIPC, which included enhancing privacy breach procedures, implementing real-time audit functions, and utilizing automated auditing software for better monitoring.
The Provincial Health Services Authority disclosed that 26 of its staff members had breached patient privacy, and various employees, including nurses, administrative staff, a pharmacist, and medical students, were involved in the unauthorized access. Disciplinary actions ranged from warnings to terminations, with most employees facing suspension as a consequence of their actions.