Yellowknife resident says he's lost faith in the health-care system after repeated privacy breaches

A Yellowknife occupier says he’s missed trust in the soil’s health-care scheme and wants to see more transparency after repeated breaches of his privacy.

The letter reads that someone, without permission, accessed Card’s personal health information.

The news came as a shock to him, he said.

“I had no idea that my privacy had been breached," he said.

"I had no idea that it was over two years old."

There were 574 health information privacy breaches at the NTHSSA between October 2015 and April 2025 that were investigated, confirmed and mitigated, according to a 10-year report on the Northwest Territories Health Information Act, tabled March 4 by the Department of Health and Social Services.

But details on Card’s most recent breach remain a mystery, he said. 

The incident happened between February 2024 and June 2025, the letter said.

Card only got the letter this March.

The document does not say who breached Card's records or why, but it did say it was a staff member.

It said the NTHSSA revoked that staff member's access to certain information systems, but what specifically they accessed is unclear.

It could have been Card’s name, address emergency contact and more, it said

Card said this isn't the first time his privacy has been breached; another instance dates back to 2020, when Card said a doctor at the Frame Lake Community Health Clinic found a physician's report with Card's name on it containing somebody else's medical information.

The Office of the Information and Privacy Commissioner asked the NTHSSA to investigate, according to documents shared with Card.

The physician, a locum, promised Card he'd find out what happened. But Card never heard back, he said, and the doctor had left the clinic by the time he followed up.

Card said he has raised his concerns with the privacy commissioner’s office and asked for more details on why his privacy keeps getting breached.

“The fact that I am repeatedly getting letters telling me that my information's been breached is troubling. It makes me feel that I'm not being heard when I make complaints about it,” he said.

The N.W.T. Government's 10-year report found more than 750 health information privacy breaches across the N.W.T. Health system between October 2015 to April 2025. 

That includes breaches involving the NTHSSA, the Hay River Health and Social Services Authority, the Tłı̨chǫ Community Services Agency, the former Covid-19 Coordinating Secretariat and the Department of Health and Social Services.

David Fraser, a privacy lawyer at McInnes Cooper in Halifax, said it’s common across Canada for privacy breaches to happen. But when they do, it seems the N.W.T. Provides less information than other provinces about what happened.

“Information about who has been snooping in your medical file is often routinely provided where that information is available,” said Fraser. 

“If you get a notification from a health authority saying, ‘We regret to inform you that we've discovered anomalous and unauthorized access to your record,’ in many cases, they will provide the name or at the very least the role of the person who was found to have snooped,” he said.

Fraser said breaches matter because residents can lose faith in their healthcare system, which comes with further repercussions. He also said people might not give doctors and nurses all the information that's necessary for them to receive appropriate care, for example.

But reducing breaches is not so simple, Fraser added. 

“People would die if the emergency room nurse had to call the help desk to get access to particular files on a patient-by-patient basis,” he said. “It's really important that everybody who should have access has ready access. And so the system generally depends on auditing tools and supervision, and then discipline.”

“What is important is that they are identified, and steps are taken to mitigate or prevent future breaches of a similar nature,” the authority said.

When breaches happen, the authority said, teams review policies and procedures with staff to make improvements. It said a mandatory training policy also requires annual privacy training for employees. 

“This ensures staff are ‘privacy aware’ and understand their roles and responsibilities when handling information and protecting clients’ privacy,” according to the authority. 

The authority also said it's standard practice not to name who accessed information inappropriately, and that's standard across Canada.

"Letters do not name employees because they include only the minimum necessary information, avoid affecting an ongoing investigation, and protect employee privacy and due process," the authority said.

Clients can request a record that shows who has accessed their personal health information in the territory's electronic health information systems.

Reporter

---

---