Why did a St. Joe’s staff member snoop into the files of a dead mother and a baby boy who are unrelated but share a last name?

They live on opposite sides of the country but have two things in common: the same last name and the same disturbing experience of learning a hospital staffer snooped into their loved one's health records.

For Arthur Gallant, it was his deceased mom's records.

For Shauna Gallant, it was her baby boy's records.

Neither know what to make of the situation or why the staffer accessed their loved one's files.

Last month, The Spectator wrote about Arthur's experience with the St. Joseph's Healthcare Hamilton breach. But Shauna, who lives in Hamilton, only learned of her son's privacy breach this week. When she opened her letter - addressed to her now two-year-old son, Bentley Gallant, who was born at St. Joe's - she was confused. Wanting to learn more about privacy breaches, she searched the internet and came upon Arthur's case.

That confused her even more.

Is this a last name that this person was targeting?" Shauna asked in an interview with The Spec. It's really creepy. It makes me feel unsettled."

St. Joe's confirmed the same staff member was involved in both incidents.

This incident is part of the previous incident for which you contacted us," read a statement from Maria Hayes, St. Joe's spokesperson, to The Spec on Thursday. A staff member was searching for a family member's health record, and in doing so came across the demographic information - i.e. name, address, date of birth, phone number, medical record number, language preference, ethnicity, primary-care provider, alias and recent hospital appointment dates - of other individuals with a similar name."

Hayes said the staff member was disciplined, and acknowledged they breached the hospital's privacy policy.

They have been retrained on privacy policies and practices," Hayes said. Furthermore, the staff member has attested they have not made use of the information."

Hayes previously told The Spectator that in the last year, the hospital has uncovered five instances where staff have accessed health records for reasons other than their hospital duties."

It's not clear if other people's files were accessed in the Gallant breach.

Shauna's son's files were accessed twice, on March 17, 2021 and Oct. 19, 2020. Arthur's mom's file was accessed on March 26, 2021. The letters informing both parties of breaches were sent Jan. 18, 2022.

Gallant, who is from Hamilton but now lives in Calgary, said learning of Shauna's case further cements his distrust of how the hospital trains and disciplines staff and handles privacy breaches.

How did the employee not know what they were doing was wrong?" he said.

He said his mental health has suffered since he learned of the breach of his late mother's records.

Privacy is such a sacred thing," he said.

In a followup letter to Shauna this week, St. Joe's shed more light on the breaches.

Because the search specifically requested the last name Gallant', the employee's search on our system resulted in your son's demographic information listed above being displayed on the computer screen," read the letter from Wendy Lawrence, chief risk, legal and privacy officer at St. Joe's. The reason our system displays limited demographic information when a patient search is conducted is so that staff can confirm the identity of a patient before clicking on that patient's name and actually accessing their health records."

Despite the first letter stating there was inappropriate access" to records containing (Bentley's) personal health information," the second letter stated: We want to make clear that your son's health records were not accessed."

Lawrence went on to say the hospital network is committed to protecting patients' privacy and is also committed to promoting a just culture that recognizes that employees can make mistakes, learn from these mistakes and change."

The second letter left Shauna even more upset.

It just makes me angry that they are justifying why this person did it," she said. They're making excuses so that this doesn't go any further."

Katrina Clarke is a reporter at The Spectator. katrinaclarke@thespec.com