Saskatchewan Health Authority (Re)
Privacy Commissioner — April 23, 2026

A pharmacy technician disclosed a patient’s pregnancy and later her hospital admission to acquaintances via Snapchat – without consent, without authority, and apparently without understanding why it was wrong. In Saskatchewan Health Authority (Re), 2026 CanLII 39165 (SK IPC), the Privacy Commissioner found a clear breach of the Health Information Protection Act but also found that the employer’s safeguards were adequate – the problem was the individual, not the system.

Background

A pharmacy technician employed by the Saskatchewan Health Authority (SHA) disclosed a patient’s health information – first her pregnancy, then her hospital admission to deliver – to two acquaintances via Snapchat on two separate occasions (September 2023 and April 2024). The disclosures were made without the patient’s consent.

The complainant learned of the disclosures well after the fact (Snapchat messages auto-delete) and complained to SHA. SHA investigated but initially told the complainant that no inappropriate access to health records had occurred. Dissatisfied, the complainant escalated to the Office of the Information and Privacy Commissioner.

The Decision

The Commissioner found HIPA applied, a privacy breach occurred, and the technician had no authority and no consent to disclose the complainant’s personal health information. However, the Commissioner also found that SHA had sufficient administrative safeguards in place. The breach was caused by the technician’s individual failure to comprehend or follow those safeguards – not by a systemic gap in SHA’s privacy framework.

SHA took appropriate steps on containment and notification, and appropriate corrective action against the technician, including discipline and retraining. No further recommendations were made.

Key Takeaway

This case illustrates that even robust administrative safeguards cannot prevent every breach—particularly where the disclosure happens through personal messaging rather than unauthorized system access. For health-sector employers, the case reinforces the importance of privacy training that goes beyond system controls and emphasizes that personal knowledge gained through employment is equally protected. It also shows that where an employer has adequate policies and takes appropriate corrective action, the Commissioner will not impose additional systemic recommendations.