Sask. Health Authority accidentally outs employees who were part of mandatory COVID testing program

About 200 Saskatchewan Health Authority (SHA) employees were accidentally identified by name in an email as participants of the organization's now-scrapped mandatory testing program.

The SHA ended its vaccine and testing mandate Monday. Before that, its approximately 44,000 employees had to provide proof of vaccination or enrol in a mandatory testing program at their own cost.

Employees had to test three times a week. The program cost them $225 per month, according to the "Monitored Testing Program Handbook" sent to staff in November. 

CBC News obtained a copy of the email the program sent on Feb. 11. It disclosed that employees were participants of the testing program and informed them that the program was ending, with all payroll deductions stopped.

The email was sent to employees in alphabetical groups by their first names. One group had 104 employees, while another had 98. The SHA confirmed to CBC that about 200 health-care workers were affected. 

About an hour-and-a-half later, another email was sent to employees saying recipient names were "inadvertently added to the CC (carbon copy) field, instead of the BCC (blind carbon copy) field."

"We apologize for the error," the email stated, but it said the initial email was not a breach of employees personal health information as it "does not disclose whether or not the individuals listed in the email are vaccinated or not." 

It only disclosed that the employee is part of the testing program, the email said. 

An employee identified in the email, who doesn't want to be named over fear of losing their job, says the email "does imply we're unvaccinated."

"What it is disclosing very blatantly is that we are in the testing program. We're being tested for COVID-19 regularly. And disclosure of a health-care test is our personal health information," they told CBC News on Tuesday.

"For those whose personal email address was included in the distribution list, the error is considered to be a breach of personal information under The Local Authority Freedom of Information and Protection of Privacy Act," wrote Tammy Martins, the executive director of quality and safety at the SHA, in a prepared statement Wednesday.

"We have reached out to this group of employees directly, have apologized for the error, and requested that they delete and remove the email immediately."

However, Martins maintained that the SHA's error is not considered to be a breach of health information, as it does not disclose the individuals' vaccination status.

The statement also noted that vaccinated employees could enrol in the testing program in the event they are vaccinated but chose not to disclose their status to the SHA.

Employees were told that if they're not satisfied with the SHA's response, they have the right to make a formal complaint to the Office of the Information and Privacy Commissioner. 

Saskatchewan's Information and Privacy Commissioner, Ron Kruzeniski, told CBC News he can't currently provide a comment because it appears his office will receive a complaint about this incident and that there have already been a couple of inquiries, which he said usually result in complaints. 

This is not the first time the SHA accidentally outed employees in relation to vaccine and testing policies.

In October, the SHA apologized for sending out a widely distributed internal email that identified by name hundreds of employees who may not have disclosed their COVID-19 vaccination status by a stated deadline.

The SHA said then that it was reviewing its process to ensure this type of email is sent more discreetly in the future. It repeated that it's reviewing the recent incident to ensure it doesn't happen again. 

Barbara Cape, the president of SEIU-West which represents SHA health-care workers, called the recent error "boneheaded" and says union members are disappointed and angry.

"The members that I've talked to have said they are subject to scrutiny in their workplaces and they're subject to scrutiny outside of their workplaces when this sort of thing happens," she said.

"I think that the SHA should put a full-throated apology forward because this is ridiculous."