On October 27, 2016, the Discipline Committee of the College of Physicians and Surgeons of Ontario found that Dr. Dr. Francesca Anne Di Paola has committed an act of professional misconduct in that she has engaged in conduct or an act or omission relevant to the practice of medicine that, having regard to all the circumstances, would reasonably be regarded by members as disgraceful, dishonourable or unprofessional, specifically, by repeatedly accessing confidential and sensitive personal health information of Patients A and B without consent or legal authority, when she knew she had no authority to do so, and by acting in a conflict of interest in relation to Patient A’s care.

Dr. Di Paola, a family physician, practices in the area of addiction medicine at the Centre for Addiction and Mental Health (“CAMH”) in Toronto.

Dr. Di Paola had a close personal connection to Patients A and B.

Both Patient A and Patient B have accessed services at CAMH. Patient A was an in-patient at CAMH between April and May 2014.

In February 2015, concerned about potential unauthorized access of his medical record by Dr. Di Paola, Patient B requested that a “lockbox” be implemented on his medical record at CAMH. A lockbox is a restriction on access to a patient’s medical record, imposed at the request of the patient. In Patient B’s case, he requested that access to his medical record be restricted to two specific physicians at CAMH. He also requested a list of all individuals who had accessed his CAMH medical record at any time.

On another date in February 2015, also concerned about potential unauthorized access of her medical record by Dr. Di Paola, Patient A requested that a lockbox be implemented on her medical record at CAMH, on similar terms to those requested by Patient B. She also requested a list of all individuals who had accessed her CAMH medical record at any time.

DR. DI PAOLA’S ACCESS OF MEDICAL RECORDS

Pursuant to Patient A’s and Patient B’s the requests, CAMH conducted an internal audit which revealed that Dr. Di Paola had accessed or attempted to access Patient A’s medical records on 10 separate dates between May 2012 and August 2014. The audit also revealed that Dr. Di Paola had accessed or attempted to access Patient B’s medical records on 9 separate dates between May 2012 and September 2014.

Dr. Di Paola did not have consent or any other legal authority to access the medical records of Patient A or Patient B on any occasion.

In CAMH’s current database system, iCARE, which was implemented in May 2014, a physician must declare that he or she is in a treating relationship with the patient, and set out the nature of that relationship, in order to be granted permission to access a patient’s medical records.

 

 

 

Dr. Di Paola attempted to access Patient A’s medical records through iCARE on a date in August 2014. She did not declare a treating relationship with Patient A, and so was not granted access to Patient A’s medical records on that date.

Dr. Di Paola attempted to access Patient B’s medical records through iCARE on a date in
September 2014. She did not declare a treating relationship with Patient B and so was not
granted access to Patient B’s medical records on that date.

When Dr. Di Paola accessed Patient B’s medical records through iCARE on a date in September 2014, she declared herself to be an “Attending Physician” in order to gain access. On that date, Dr. Di Paola was the attending physician on the unit where Patient B was a patient, but she did not have his consent or legal authority to access his medical records. Dr. Di Paola also accessed Patient B’s medical records through iCARE a few days later.

On a later date in September 2014, Dr. Di Paola, having previously been the attending physician on Patient B’s unit, received an Inbox message sent to all of Patient B’s physicians at CAMH. Dr. Di Paola did not access Patient B’s medical records through iCARE on that date.

The medical records of Patient A and Patient B accessed by Dr. Di Paola included personal health information of a very sensitive nature, namely information related to psychiatric and addictions issues. Patient A and Patient B expected that this information would be kept confidential.

In the summer of 2014, Dr. Di Paola was invited to attend a meeting regarding Patient A’s care at a hospital by virtue of Dr Di Paola’s close personal relationship with Patient A. This meeting was attended by Patient A’s treating physician and by a Children’s Aid Society social worker who had been involved with Patient A’s family. At that meeting, Dr. Di Paola took a position with respect to Patient A’s access to Patient A’s child that was adverse to the position taken on this issue by Patient A’s treating physician.

CAMH POLICIES AND PRIVACY EDUCATION

On December 10, 2012, Dr. Di Paola signed a letter of offer of appointment to the medical staff at CAMH. On April 17, 2013, Dr. Di Paola signed a letter of re-appointment to the medical staff at CAMH. Each letter provided that, by signing the letter, Dr. Di Paola confirmed that she was familiar with the Personal Health Information and Privacy Protection Act and was aware of, and agreed to honour, her obligations set out therein. Each letter also provided that acceptance of the appointment entailed Dr. Di Paola’s agreement to govern herself in accordance with all CAMH Policies, which included a Privacy Policy.

Dr. Di Paola completed CAMH’s e-learning program on Privacy Fundamentals on April 26,
2012 and again on August 31, 2014.

Dr. Di Paola was aware each time that she accessed the medical records of Patient A and Patient B that she was doing so without authority or consent.

CAMH DISCIPLINARY ACTION

The Medical Advisory Committee at CAMH, where Dr. Di Paola holds privileges and where the breaches of privacy occurred, took disciplinary action against Dr. Di Paola.

The disciplinary action consisted of a two-week unpaid leave of absence; the completion of two courses addressing issues relating to professional boundaries and privacy and confidentiality (the Boundaries course at the University of Western Ontario, and the Osgoode Hall Law School Professional Development course entitled “Legal Guide to Privacy and Information Management in Health Care”); and the drafting of three letters of apology, one to Patient A, one to Patient B and one to CAMH as an organization.

PENALTY

On October 27, 2016, the Discipline Committee ordered and directed that:
- Dr. Di Paola appear before the panel to be reprimanded;
- The Registrar suspend Dr. Di Paola’s certificate of registration for a period of three (3) months commencing at 12:00 a.m. on October 31, 2016; 
- The Registrar impose the following term, condition and limitation on Dr. Di Paola’s certificate of registration:
- Dr. Di Paola will participate in and successfully complete, within six (6) months of the date of this Order, five (5) hours of individualized instruction in medical ethics with an instructor approved by the College, with a report or reports to be provided to the College regarding Dr. Di Paola’s progress and compliance.
- Dr. Di Paola pay costs to the College in the amount of $5,000.00 within 30 days of the date of this Order.