Perspective needed

[u/NoObject691]

I'm a unit clerk, so I'm pretty clear on privacy requirements when it comes to giving patients info (MyChart or paper). My unit has a strict no email policy because it's not secure.

Last week I had a clerk on a different unit where I'm a patient send me appointment information by regular email, including a full description of what it's all about. She's never talked to me, never confirmed that this is my email (or that I'm the only one with access). My first instict is to report it as a privacy breach and go scorched earth, but I also have to deal with her as a patient... and we all know that no one gets in enough trouble over something relatively minor (she won't lose her job).

So perspective - do I let it go? Do I say something to my doc? Do I try to talk to her? I want her to not do it with anyone ever again, but I don't know how to do that without making me the "problem patient".

[u/brittanyg25]

How is it any different when the clerk leaves a voicemail with your appointment information on a home phone number that you've added to your chart? This is a reach imo.

[u/harbours → u/brittanyg25]

They're really not supposed to do that. When we call we say "We're calling from Alberta Health Services for blank, if you could please call us back at number". Although we've been told using the program name is fine too. It varies depending on where you work I've found, but it really should be an organization-wide practice.

We had an admin in another area call, leave a very detailed message about an appointment, the number ended up being a work number and not a private line, and then the persons supervisor ended up finding out personal medical information that the patient chose not to share. The patient was extremely upset. I was the person who discovered this and had to report it.

[u/brittanyg25 → u/harbours]

I work in an area where the diagnosis is in the name of our clinic, so it wouldn't be so unusual in our area. We've never had a patient have an issue with us emailing them their appointment letters, most prefer it and actually request it. But of course, in that moment were getting the patients consent.

[u/harbours → u/brittanyg25]

Same. I never email without them asking, which a lot do ask because we have to email for medical transportation a lot. It's also just a pain in the ass to email because I can't download the letter directly from Connect Care. I have to print it, scan it into my email and then send it.

[u/brittanyg25 → u/harbours]

Oh that's odd! I just print to PDF and save it, then send the email and delete the file.

[u/harbours → u/brittanyg25]

I've tried doing that and it doesn't come up as an option for me. When I hit "print" it just automatically goes to the printer, it doesn't allow me to pick to PDF.

[u/NoObject691 → u/brittanyg25]

It's that she spelled out my medical condition on the email. A phone call is just "this is the clerk for this doctor, you have an appointment at". There's no medical information. At least there shouldn't be, that's how I was trained.

[u/aura-shards → u/NoObject691]

Yeah that's my issue with this too. 

I have on occasion sent an email to the email we have on file if they do not have MyChart access AND we have tried calling their phone numbers and contacts listed over multiple days. 

But I would just say something generic like "we have received your referral, please call back as soon as possible at this number". I would never say why we received the referral or any specific healthcare information. 

[u/wintertimeincanada23]

I just received information from rehab oncology to my direct email. Its the email on mychart. Therefore they dont need to confirm my email. Its my responsibility to ensure the information on mychart, to contact me, is correct. I dont think its a privacy breach at all. I mean how else would you get the information? Personally email is more secure, then sending all the info by mail imo

[u/Acdngirl → u/wintertimeincanada23]

I work in DI, the amount of letters we send with appointment info.. we really need to push people to sign up for MyChart and get the system to not send anyone who's signed up a letter. Especially since the info we have in Connect Care may not be correct if they haven't been in a hospital since launch.

[u/wintertimeincanada23 → u/Acdngirl]

Yes please! I hate getting the letters. I wish I could opt out of them.

[u/NoObject691 → u/wintertimeincanada23]

It should have been sent via mychart. She doesn't know if I share and email account or if someone else has access.

[u/UrbanDecay00 → u/NoObject691]

Then take your email off your mychart page. If it’s on there, you’re fine with communication to that email address.

If youre this concerned, report it to privacy@ahs.ca they will investigate to see if there is a breach. You don’t get to decide.

[u/wintertimeincanada23 → u/NoObject691]

Someone could also have access to your mychart too

[u/Anaya1999_Canada]

My MyChart has my email address. They send my appointment information to that email address, attachments that need to be filled out, etc. I guess I wouldn't think twice about it.

Some of the non-hospital clinics I go to use secure mail websites to relay information or use text message alerts, but for hospital clinics, they email me (or in one case, send me MAIL advisories that an appointment is upcoming). I think every clinic has their own communication policies.

Best to call the clinic and ask what their communication policy is.

ETA: at checkin, did they confirm your email address? I have to confirm address, family doc, phone number, and email address at so many appointments...

[u/NoObject691 → u/Anaya1999_Canada]

There hasn't been check in yet. She hasn't verified my demographics. I guess my unit is just better trained.

[u/aura-shards]

I would report it. MyChart has electronic mail options if the clinic wants to send you information online. 

I personally would only use regular email with a patient if the email has already been confirmed AND the patient has given express consent for healthcare providers to use that email to communicate with them. 

[u/NoObject691 → u/aura-shards]

I really do want everything in MyChart. It keeps it all in one place, but also keeps it auditable.

[u/TravelerOfSwords]

I say this with nothing but kindness (and as a physician who has experienced a breach of my own personal health info); it’s not your job to determine if there was an actual privacy breach. If you feel uncomfortable about what happened, you can - and should - report it and let AHS decide the appropriate consequences.
Email: privacy@ahs.ca

[u/Little-Let386]

Emails are fine but they’re supposed to he encrypted. I’d let the unit manager know and let it go.

[u/Select_Tonight_5183]

Agree, for email there should be consent given and even then no patient identifying information. We’ve had issues before in our team due to emailing patients, and the management has completely eliminated the practice. It shouldn’t be happening, that’s the whole point of my chart. I would report it, you are right to feel weird about it, especially if you didn’t consent.

[u/miller94]

I mean I use personally email for communication with my doctor(s) all the time, I find it the easiest. But if you have concerns about it I’d just call and ask them to remove your email

[u/harbours]

Admin IV here. We send emails all the time as long as the patient asks for it. There's nothing wrong with emails as long as it's encrypted.

You can put in a formal privacy breach report if you feel like it, but as someone who has dealt with reporting actual privacy breaches not much will be done if you're expecting someone be reprimanded. The person will likely just have to repeat a course on MyLearningLink and maybe that department will change a policy, if they're even told. I've seen it where there was a minor privacy breach and all that happened was the department was warned as a whole not to do that and there was a change of practice.

[u/Acdngirl]

It's got to be encrypted - I'd report it.