A discipline panel of the College of Nurses of Ontario, or CNO, found former Registered Nurse Jean Ann Caldwell guilty of professional misconduct for accessing the personal health information of sixteen patients without authorization1. In a decision dated January 23, 2025, the panel accepted a joint submission on penalty that included an oral reprimand and a binding undertaking from Ms. Caldwell to permanently resign from the nursing profession.
The events leading to the discipline hearing occurred between January and May 2021 while Ms. Caldwell was employed as a Registered Nurse at Belleville General Hospital, which is operated by the Quinte Health Care Corporation, known as QHC. Ms. Caldwell had been registered with the CNO since January 1988 and had no prior disciplinary findings.
The matter was brought to the hospital’s attention on or around May 2, 2021. A nursing colleague reported to the Interim Manager of the Quinte 4 Surgical Unit that they had witnessed Ms. Caldwell accessing the personal health information of a patient identified as Patient J. This patient was a retired physician who had practiced at the hospital. The colleague expressed concern because Ms. Caldwell was not part of Patient J’s circle of care.
This report triggered a formal audit by the hospital’s privacy officer, examining all of Ms. Caldwell’s access to the electronic medical records, or EMR, system from January 1, 2021, to May 6, 2021. The QHC EMR system tracks all user access, including what parts of a record were viewed, the time of access, and the location of the computer used. The audit revealed that during this period, Ms. Caldwell had accessed the personal health information of 16 different patients without consent, authorization, or any professional purpose.
At the time of the incidents, Ms. Caldwell had returned to work following a medical leave for a workplace injury. She was assigned to modified duties, first in the Sills 4 Complex Continuing Care Unit starting in January 2021. In this role, she did not have an assigned patient load; her duties involved guiding other staff and assisting with tasks within her physical limitations. In late March 2021, she returned to her home unit, Quinte 4, but remained on modified duties. After sustaining another injury in late April 2021, her modified duties on Quinte 4 were updated on May 1, 2021, to include completing hand hygiene audits, patient surveys, and pressure wound audits.
According to the Agreed Statement of Facts presented to the panel, these modified duties did not require the level of access Ms. Caldwell engaged in. To complete pressure wound audits, for example, she was only required to review the process interventions section of a patient’s EMR. If no pressure injury intervention was listed, she was instructed to ask another nurse or look at the physical interventions section. The hospital’s position was that there was no need for her to access any other part of the patient record for these tasks.
The audit detailed a pattern of unauthorized access. While working in the Sills 4 unit, Ms. Caldwell accessed the charts of patients in other units. This included accessing Patient A’s chart on January 28, 2021, while the patient was in the Quinte 4 surgical unit. On February 2, 2021, she accessed various parts of Patient B’s chart, who was in the Quinte 6 Medicine Unit, and Patient C’s chart, who was in the Quinte 4 surgical unit. The audit also found she accessed offsite records from other QHC hospitals without reason. This included viewing Patient D’s offsite records from the Picton site on March 16 and 21, 2021, and Patient E’s Picton records on March 21. She also viewed Patient F’s offsite records from the Trenton site on March 16 and 21, and Patient G’s Trenton records on April 8, 2021.
The improper access continued after she moved back to the Quinte 4 unit. On May 1, 2021, she accessed Patient J’s chart for more than six minutes, viewing various parts of the chart, including recent clinical results, without any professional purpose. On May 2, 2021, she accessed the offsite Trenton records for Patients L, N, O, and R, and the offsite Picton records for Patient M, again with no reason to review them. On May 6, 2021, she spent approximately four minutes in Patient W’s chart, accessing past orders and entries, which was beyond the scope of her pressure wound audit duties. Two patients, Patient Q and Patient Y, had their records accessed by Ms. Caldwell while she was working in both the Sills 4 and Quinte 4 units, at times when the patients were not in her unit of work.
In the Agreed Statement of Facts, Ms. Caldwell admitted that she accessed the personal health information of all sixteen patients without consent, authorization, or professional purpose. She noted, if she were to testify, that the events occurred after her return from medical leave during the COVID-19 pandemic and while she was on modified duties. She would also have testified that she perceived she received minimal training for her assigned tasks. However, she formally acknowledged that she had a professional obligation to ensure she did not access or review any personal health information that was not necessary for her assigned tasks. Regarding Patient J, she would have stated she had no personal or professional relationship with the retired physician and that the access occurred while she was attempting to complete her audits, but she acknowledged the access was improper.
The hospital’s policies and provincial law were central to the case. The Personal Health Information Protection Act, 2004, or PHIPA, governs health information in Ontario and requires consent to collect, use, or disclose personal health information, with “use” being defined as including viewing or handling the information. QHC had several relevant policies, including a “Privacy” policy and a “Behaviour at Work” policy, both requiring employees to respect and preserve patient privacy. The hospital also had a “Training and Awareness” policy. Records showed Ms. Caldwell last received privacy training from QHC on February 6, 2021, during the period of the improper access. She had also signed Confidentiality, Information Access and Security Statements in 2002 and 2009, acknowledging her legal and professional responsibilities.
The College of Nurses of Ontario also has binding standards of practice. The CNO’s Code of Conduct requires nurses to act with integrity to maintain patients’ trust and to protect the privacy and confidentiality of personal health information. The Professional Standards obligate nurses to ensure their practice meets legislative requirements, with the ethics standard specifically identifying “assuring privacy and confidentiality” as part of ethical nursing care. Furthermore, the CNO’s Confidentiality and Privacy: Personal Health Information standard explicitly requires nurses to access information for their own patients only and not to access any information for which there is no professional purpose. Ms. Caldwell admitted that her conduct contravened all of these standards.
Ms. Caldwell faced two formal allegations of professional misconduct. The first alleged that she contravened a standard of practice of the profession. The second alleged that she engaged in conduct relevant to the practice of nursing that would reasonably be regarded by members as disgraceful, dishonourable, or unprofessional. After several related allegations were withdrawn by the College, Ms. Caldwell entered a plea admitting to the remaining allegations. The panel conducted an inquiry and was satisfied the plea was voluntary, informed, and unequivocal.
The Discipline Panel found that the evidence in the Agreed Statement of Facts supported findings of professional misconduct for both allegations. The panel affirmed that Ms. Caldwell’s conduct breached the Code of Conduct by failing to maintain patient trust and protect privacy, thereby undermining public confidence in the profession. Her actions fell below the Professional Standards, particularly the ethics standard. The panel found her conduct was unprofessional as it “demonstrated a serious and persistent disregard for her professional obligations.” The panel also found the conduct to be dishonourable, stating it “demonstrated an element of moral failing” through a pattern of accessing records over several months for patients not in her care, which she “knew or ought to have known” was unacceptable.
Counsel for the College and for Ms. Caldwell proposed a joint submission on penalty. The primary component was an order requiring Ms. Caldwell to appear before the panel for an oral reprimand. This order was linked to an Undertaking and Agreement she had signed, which constituted her permanent resignation from the College, effective January 23, 2025.
The terms of this undertaking are extensive. Ms. Caldwell agreed to permanently resign and to never apply for membership with the CNO as either a Registered Nurse or Registered Practical Nurse in the future. The public portion of the College’s Register will indefinitely state that she entered into this undertaking to resign as part of a resolution of professional misconduct allegations. Consequently, she has no right to the reinstatement of her certificate, no right to use the title “Nurse,” “RN,” or any variation, and no right to hold herself out as qualified to practice nursing in Ontario. The College is also authorized to provide a copy of the undertaking to any other nursing governing body in Canada or elsewhere in response to an inquiry.
When arguing for this penalty, College Counsel cited aggravating factors, including the pattern of misconduct over time, the fundamental breach of patient confidentiality, and the discredit brought to the profession. Mitigating factors included Ms. Caldwell’s cooperation, her admission of the allegations, and her lack of any prior discipline history. The panel was presented with previous cases showing that in similar instances of privacy breaches where a member did not agree to resign, penalties included significant suspensions of their registration.
The Discipline Panel accepted the joint submission, finding it was not contrary to the public interest and would not bring the administration of justice into disrepute. The panel stated the penalty satisfies the goals of general deterrence, as the oral reprimand and the permanent mark on the public register send a message to the profession. Specific deterrence, rehabilitation, and remediation were not considered relevant, as Ms. Caldwell will no longer be practicing nursing. The panel concluded that the public is protected by her permanent resignation. The panel noted that had Ms. Caldwell not entered into the undertaking to permanently resign, it would have ordered a suspension of her certificate of registration.
Read more cases about proceedings in regulated professions here.
