B.C.’s information and privacy commissioner has found 71 incidents of snooping by 36 health-care workers in B.C., following the Lapu Lapu Day tragedy in April 2025.
Commissioner Michael Harvey said 16 people who were sent to medical facilities after the vehicle attack in Vancouver had their privacy breached. That’s half of the individuals sent to medical facilities, according to the investigation publicly released Wednesday (Feb. 18).
Harvey also found that the 16 people weren’t notified in a reasonable time.
Eleven people were killed in the SUV attack at the Filipino festival in Vancouver on April 26. At least two dozen others were injured.
Harvey’s office has since made nine recommendation, as well as five findings regarding Freedom of Information and Protection of Privacy Act. The recommendations included disciplinary guidelines and measures.
The investigation found that 36 health-care workers from across the Fraser, Vancouver Coastal and Provincial health authorities breached patient privacy.
The Office of the Information and Privacy Commission for B.C. received notifications of the breaches from the health authorities between April 30 and June 20, 2025.
“Snooping is illegal, unethical, and an egregious and intentional invasion of our privacy, and it breaks trust with those in healthcare that are serving us in a time of need. People in British Columbia have a right to know if their sensitive medical information has been breached,” Harvey said.
The report focuses on how the breaches violated section 25.1 of the act, which prohibits an employee, officer or director of a public body or an employee or associate of a service provider from collecting, using or disclosing personal information, except as authorized by the act.
Harvey said the three health authorities had “reasonable safeguards” in place to try and prevent breaches and how to respond to them.
“As we move deeper into digitization of healthcare services, where more information is collected and accessible through the use of multiple information systems, it is essential for public bodies, and those that work for them, to uphold their obligations to protect personal information,” he said.
“Only by doing so can the public’s trust in their healthcare system be maintained.”
The nine recommendations included:
• Clearly convey in privacy training that system activities are monitored and that discipline will be imposed for snooping.
• Plainly state in confidentiality agreements that system use is monitored and consequences will be imposed for breaches of privacy and confidentiality.
• Vancouver Coastal and Fraser health authorities update their privacy breach notifications to include information about mandatory breach notification requirements.
• Vancouver Coastal Health develop disciplinary guidelines for privacy breaches that involve snooping.
• Vancouver Coastal Health and the Provincial Health Services Authority must provide notification as required by section 36(2) of the act, subject to the circumstances listed under section 36.3(3).
• Continue existing efforts to deploy automated auditing software, with a focus on real-time alert generation and automated access prevention where possible.
• Review role-based access controls to prevent access rights from being inherited or mistakenly applied.
• Apply disciplinary measures for snooping that are strong enough to effectively sanction and deter snooping, including notifying regulatory colleges as required or appropriate.
Harvey called on all public bodies to review his report’s nine recommendations, as well as their own protocols to prevent snooping and “reinforce that it cannot be tolerated.”
Health Minister Josie Osborne said this is “new information that is very difficult” for victims, friends and families to hear that employees “would take the opportunity to look into confidential privilege and confidential information to satisfy their own curiosity or some other need.”
“It is illegal. It is unethical and it is completely unacceptable.”
Osborne said there were some consequences for some employees, with some being issued letters while others were suspended. She added some people did lose their jobs as a result.
“It is a message for, I think, all health authority employees about just how important it is to respect that confidentiality of an individual, the dignity and the trust that they have,” she said. “The trust they have in government to keep those records confidential is absolutely essential.”