Sask. Health Authority accidentally outs employees that were part of mandatory COVID testing program

About 200 Saskatchewan Health Authority (SHA) employees were accidentally identified by name in an email as participants of the organization's now-scrapped mandatory testing program.

The SHA ended its vaccine and testing mandate Monday. Before that, its approximately 44,000 employees had to provide proof of vaccination or enrol in a mandatory testing program at their own cost.

Employees had to test three times a week. The program cost them $225 per month, according to the "Monitored Testing Program Handbook" sent to staff in November. 

CBC News obtained a copy of the email the program sent on Feb. 11. It disclosed that employees were participants of the testing program and informed them that the program was ending, with all payroll deductions stopped.

The email was sent to employees in alphabetical groups by their first names. One group had 104 employees, while another had 98. The SHA confirmed to CBC that about 200 health-care workers were affected. 

About an hour-and-a-half later, another email was sent to employees saying recipient names were "inadvertently added to the CC (carbon copy) field, instead of the BCC (blind carbon copy) field."

"We apologize for the error," the email stated, but it said the initial email was not a breach of employees personal health information as it "does not disclose whether or not the individuals listed in the email are vaccinated or not." 

It only disclosed that the employee is part of the testing program, the email said. 

An employee identified in the email, who doesn't want to be named over fear of losing their job, says the email "does imply we're unvaccinated."

"What it is disclosing very blatantly is that we are in the testing program. We're being tested for COVID-19 regularly. And disclosure of a health-care test is our personal health information," they told CBC News on Tuesday.

"For those whose personal email address was included in the distribution list, the error is considered to be a breach of personal information under The Local Authority Freedom of Information and Protection of Privacy Act," wrote Tammy Martins, the executive director of quality and safety at the SHA, in a prepared statement Wednesday.

"We have reached out to this group of employees directly, have apologized for the error, and requested that they delete and remove the email immediately."

The statement also noted that vaccinated employees could enrol in the testing program in the event they are vaccinated but chose not to disclose their status to the SHA.

Employees were told that if they're not satisfied with the SHA's response, they have the right to make a formal complaint to the Office of the Information and Privacy Commissioner.