The Discipline Committee of the College of Nurses of Ontario has ordered a three month suspension for a Registered Nurse who repeatedly accessed the personal health information of 23 patients without authorization over a period of nearly two years1. The nurse, Seena Thundathil Joseph, was found to have committed professional misconduct by breaching practice standards and engaging in conduct that would be regarded by her peers as dishonourable and unprofessional. The decision was rendered during a videoconference hearing on May 12, 2025.
Ms. Joseph first registered as a Registered Practical Nurse in 2012 and became a Registered Nurse, or RN, in 2019. She was employed at St. Joseph’s Health Care London from November 29, 2021, until her termination on October 5, 2023. She began as a float nurse, moving between different units as needed, and later took a part time role on the facility’s Adult Mental Health Unit around May 2022. During her employment, Ms. Joseph completed the facility’s mandatory e-learning on privacy and confidentiality in both November 2021 and October 2022, which included a review of the Personal Health Information Protection Act.
The investigation into Ms. Joseph’s conduct began in early 2022 after a high profile client, identified only as Patient K, was admitted to the facility. The facility’s privacy office conducted a proactive audit of staff access to Patient K’s electronic medical record, or EMR, on April 29, 2022. This audit revealed that Ms. Joseph had accessed Patient K’s EMR on February 20, 2022, despite not being in Patient K’s “circle of care,” the term used to describe the healthcare professionals directly involved in a patient’s treatment.
This initial finding prompted the privacy office to conduct a broader audit of Ms. Joseph’s historical EMR access in May 2022. These further audits revealed that between December 2021 and April 2022, Ms. Joseph had inappropriately accessed the EMRs of several other patients. While she had provided care to some of these patients in the past, on the specific dates she accessed their records, she was no longer in their circle of care. Facility management met with Ms. Joseph on May 6, 2022, to discuss the unauthorized access. At that meeting, Ms. Joseph explained that she had accessed the charts because she “wanted to get to know how she could help them when they were assigned to her in the future.” Management advised her that this was not an appropriate reason and constituted a breach of privacy. Ms. Joseph acknowledged her access was a “big mistake” and stated that the conduct would never occur again.
According to the facility’s report to the College of Nurses, Ms. Joseph was given one on one “circle of care” education by a privacy consultant and was informed she would be monitored. However, the agreed facts noted that if Ms. Joseph were to testify, she would deny that the facility provided her with any such one on one education or additional privacy training. Despite the warning in May 2022, Ms. Joseph’s unauthorized access continued. In September 2023, the facility conducted additional audits of her EMR access covering the period from November 1, 2022, to September 1, 2023. These audits identified that Ms. Joseph had accessed an additional five patient EMRs when she was not in those patients’ circle of care.
A second meeting was held on September 8, 2023. In this fact finding meeting, Ms. Joseph acknowledged accessing the five additional EMRs. She explained that in some cases, she accessed the records because she heard the patients might be transferred to her care, or because she had previously cared for the patient. She also informed her employer that if the facility conducted additional audits, it would “likely find additional cases” of her accessing EMRs for patients not in her circle of care. A final audit confirmed the full scope of the breaches. In total, Ms. Joseph accessed the EMRs of 23 different patients on 21 different dates between December 11, 2021, and August 27, 2023, all without consent, authorization, or professional purpose. Her employment was terminated shortly thereafter.
At the discipline hearing, Ms. Joseph admitted to the two allegations in the Notice of Hearing. She admitted that her actions contravened the standards of practice and constituted disgraceful, dishonourable, or unprofessional conduct. Through an Agreed Statement of Facts, she expressed “profound regret” for her actions. She stated her actions were “never intended to be malicious” and that she was “always motivated to provide the best possible care” and be prepared for new admissions or patient transfers. She fully agreed that it was improper to access the EMRs and apologized for her poor judgment and for breaching patient privacy.
The Discipline Panel accepted Ms. Joseph’s plea and found her guilty of professional misconduct. In its reasons, the panel noted that her conduct was a clear breach of the College’s standards on confidentiality and privacy. The panel found her conduct to be unprofessional, but also specifically found it to be “dishonourable.” The panel’s reasoning for this finding centered on the fact that Ms. Joseph continued the behavior even after being explicitly warned by her employer in May 2022. The panel described this as a “moral failing,” stating she “knowingly accessed confidential information to which she was not entitled and continued to do so even after being explicitly advised of the impropriety of the conduct.”
The College and Ms. Joseph’s legal counsel presented a Joint Submission on Order, which the panel accepted. The penalty includes three main components. First, Ms. Joseph is required to appear before the panel within three months for an oral reprimand. Second, the Executive Director of the College is directed to suspend Ms. Joseph’s certificate of registration for a period of three months.
Third, a number of terms, conditions, and limitations will be imposed on her certificate of registration. She must, at her own expense, attend a minimum of two meetings with a Regulatory Expert approved by the College, to be completed within six months. Before the first meeting, she must provide the expert with all documents from her discipline case, including the Notice of Hearing and the Agreed Statement of Facts. She is also required to review the College’s “Code of Conduct” and “Confidentiality and Privacy” standards, as well as the Information and Privacy Commissioner’s “Circle of Care” document, and complete associated Practice Reflection Worksheets to give to the expert. The sessions with the expert will focus on her misconduct, the potential consequences of her actions, strategies for preventing recurrence, and the development of a learning plan. The expert must then submit a report to the College assessing Ms. Joseph’s insight into her behavior.
Furthermore, for a period of 12 months after she returns to the practice of nursing, Ms. Joseph must notify any employer of the discipline decision. She must provide the employer with a copy of the panel’s order and related documents. She must also ensure the employer provides a report to the College confirming they have received the documents. The employer must also agree to notify the College immediately if they find any information that she has breached practice standards. Finally, if her role involves access to electronic health records, the employer must agree to perform three random spot audits of her EMR access at four month, eight month, and twelve month intervals, and provide a report to the College on her practice after each audit.
In presenting the joint submission, College counsel identified several aggravating factors, including the sensitive nature of health information, the repeated nature of the misconduct over nearly two years, and the fact that the conduct continued after she was counselled. Mitigating factors included her lack of any prior discipline, her cooperation with the investigation, her early admission of guilt, and her expression of remorse. The panel concluded that the proposed penalty was reasonable, in the public interest, and satisfied the goals of both specific and general deterrence, remediation, and public protection. The panel found the three month suspension sent a strong message to the profession, while the required education and audits would protect the public and support Ms. Joseph’s safe return to practice.
