B.C. health workers breached privacy of injured victims of Vancouver festival attack

VICTORIA — British Columbia health care workers unlawfully accessed highly sensitive personal information on victims of Vancouver’s Lapu Lapu Day festival attack mostly out of “curiosity,” the province’s privacy commission says.

A report released by the Office of the Information and Privacy Commissioner said it was notified of privacy breaches within days of the deadly attack, and an investigation found 71 instances of unlawful “snooping” on 16 victims’ medical records.

The report found 35 workers at B.C. health authorities engaged in the snooping, as well as one worker at a doctor’s office who had access to Fraser Health’s electronic medical records system.

All the employees who were implicated in the snooping incidents were disciplined by their employers, including some who were terminated, although the report said most received suspensions, while some were sent “letters of expectation.”

Privacy commission Michael Harvey’s office said its investigation found the breaches violated the Freedom of Information and Protection of Privacy Act, which prohibits an employee of a service provider from collecting, using or disclosing personal information, except as authorized by the legislation.

Harvey’s office also found that individuals whose privacy was breached weren’t notified without unreasonable delay, and the health authorities believed they weren’t required to notify affected individuals.

“Vancouver Coastal Health and (the Provincial Health Services Authority,) after assessing the risk of harm to individuals whose privacy was violated, initially took the position that notification was not required and could itself result in further harm,” the report said.

The authorities, the report said, took the view that notifying people could result in “re-traumatizing or re-victimizing them.”

The investigation also found the health authorities had “reasonable safeguards” in place to prevent and respond to breaches, and they took steps after realizing patients’ privacy was at risk, including investigations and disciplinary action.

The first report of snooping came just four days after the attack, the report said, and others occurred in the months afterward.

Employee access to the breached information is logged and recorded, and audits of their access uncovered the snooping incidents, the report said.

The 36 employees all reported “curiosity” as one of the reasons for accessing the records, with a few also reporting “concerns for their community” and for emotional or mental preparation to provide care.

One employee stated they were also “grieving the loss of a friend,” the report said.

“While these are not necessarily malicious intentions, their intentional and reckless nature indicate a risk that the personal information could be further disclosed due to general curiosity and ongoing public interest in this event,” the report said.

Fifteen workers found to have wrongfully accessed the records were nurses, and 13 were administrative support workers, the report said.

Harvey’s report includes nine recommendations, including continuing efforts to deploy automated software with a focus on preventing access to files, and applying disciplinary measures strong enough to effectively deter and sanction snooping.

“Snooping is illegal, unethical, and an egregious and intentional invasion of our privacy, and it breaks trust with those in health care that are serving us in a time of need,” Harvey said in the statement issued Wednesday.

Harvey said it’s essential for public bodies to uphold their obligations to protect personal information in order to maintain public trust in the health system.

Health Minister Josie Osborne told reporters Thursday at the legislature that it was “very difficult” for victims and their families to learn that health authority employees would take the opportunity to look into confidential and privileged information, “to satisfy their own curiosity or some other need.”

“It is illegal, it is unethical, and it is completely unacceptable,” Osborne said at an unrelated news conference, adding she was “grateful” to the commissioner for the report.

She said the consequences for those employees, including those who lost their jobs, sends a message about the importance of maintaining dignity and trust in keeping sensitive records confidential.

The Filipino cultural festival in Vancouver was the site of a vehicle-ramming attack that killed 11 people last April, while more than two dozen were injured.

This report by The Canadian Press was first published Feb. 19, 2026.

The Canadian Press