Same problem, two authorities: Alta. pharmacist accessed and disclosed patient/employee’s health data inappropriately ordered to implement privacy safeguards

An Alberta pharmacist has been ordered by the provincial privacy commissioner’s office to institute privacy safeguards at his pharmacy after having been found to have accessed his employee’s health records inappropriately—three years after having been sanctioned by the college for the same incident.In a decision released Jan. 21, 2026, the Office of the Information and Privacy Commissioner found that pharmacist Ahmed Abuel Shouhoud had contravened Alberta’s Health Information Act (HIA). In 2019, the complainant, who was both an employee at the pharmacy and also a patient of Shouhoud, had undergone a medical radiographic examination. At the pharmacy, Shouhoud asked the complainant if he wanted her to check the results of the examination on NetCare—Alberta’s provincial EHR system. The complainant declined, given that she wanted to wait to see her doctor. But despite this, Shouhoud’s still accessed the test results on NetCare.Shouhoud had claimed he only accessed the results as part of the procedure for refilling a particular prescription for the complainant. However, the adjudicator found that he had merely assumed she wanted this prescription refilled, even though she did not. The complainant had asked for a refill of a drug referred to in the documents as “Medication A,” but Shouhoud had assumed that she wanted all of her perceptions refilled, including “Medication B.” Shouhoud testified he had to check her test results to see if a particular conduction had returned, given that Medication B was contraindicated for people with that condition (There was no need to see the test results to refill Medication A). Shouhoud argued that because he was providing a health service, he was within his rights to view the complainant’s health information. However, adjudicator John Gabriele ruled that refilling the complainant’s prescription can’t be considered a valid “health service” if she never asked for it to be refilled.“Refilling the prescriptions if the Complainant did not seek to have them refilled is not a health service. It is simply a pharmacist acting unilaterally and as such would not be a health service ‘provided to’ an individual; this is so even if a custodian assumes that a health service is requested or will be requested,” Gabriele wrote.The complainant also alleged Shouhoud had disclosed her health information to a colleague three times: once verbally in front of the complainant, a second time verbally in her absence, and a third time displaying his computer screen to the colleague.The adjudicator concluded there was insufficient evidence to determine whether Shouhoud had disclosed the complainant’s health information verbally when she wasn’t in the room. However, the adjudicator did find it to be probable that Shouhoud had verbally disclosed the complainant’s health information to the colleague while the three of them were in the same room.The complainant testified that while the three of them were in a meeting, Shouhoud said her lab test results were “good” and turned his laptop towards the complainant to show her. The colleague also testified that Shouhoud said the test results were “fine” out loud but was not able to see the computer screen. Meanwhile, Shouhoud denied making any verbal disclosure of the complainant’s health information to the colleague.Gabriele concluded the colleague would have been unable to see the complainant’s health information from the computer, given the angle of the computer screen in relation to where the colleague was seated. However, he said it was “more than plausible” that Shouhoud did indeed say the results were “good” or “fine” in front of the colleague, thus constituting a breach.The adjudicator also took issue with the apparent lack of administrative, technical and physical safeguards protecting confidential health information. While it is likely that the colleague did not see the test results on the computer screen, the fact that the results were “out in the open” rather than in a private setting constituted a breach of the HIA.“The Complainant’s health information was secured neither visually nor audibly, when it should have remained private,” he wrote.Shouhoud had already been sanctioned by the Alberta College of Pharmacists (ACP) for the same incidents that were at the subject of the complaint to the privacy commissioner’s office. The college’s hearing tribunal concluded Shouhoud’s actions constituted unprofessional conduct and was issued a reprimand, fined $700, ordered to take an ethics course and pay 50% of the costs of the hearing and investigation (which totalled around $60,000).Shouhoud’s legal counsel argued to the privacy commissioner’s office that issue estoppel—the legal doctrine that prevents the parties in a case from relitigating the same facts in another court or tribunal—should apply. However, the adjudicator ruled that issue estoppel does not apply here since the case before the hearing tribunal was brought forth by the ACP’s complaints director, rather than the complainant—despite the fact that the same complainant made the initial complaint to both the privacy commissioner and the ACP. “The Complaints Director brought the complaint made to the College of Pharmacy before the Hearing Tribunal, not the Complainant; rather, the Complainant was called as one of the Complaints Director’s witnesses. It is not necessarily the case that the Complaints Director was advancing the same interests before the Hearing Tribunal as the Complainant has in this inquiry,” Gabriele wrote.The Office of the Information and Privacy Commissioner has the power to issue fines of up to $200,000, but no monetary penalties were issued in this case. Instead, Shouhoud was ordered to cease the use of the complainant’s health information. He was also ordered to implement better privacy safeguards and provide documentation to the adjudicator about such safeguards.

Same problem, two authorities: Alta. pharmacist accessed and disclosed patient/employee’s health data inappropriately ordered to implement privacy safeguards

Register for free access or login.

Related Topics