Privacy Breach Reveals Which Hospital Employees Are Unvaccinated in Email Sent to Staff

A hospital in Ottawa, Ontario, acknowledged on Tuesday that a privacy breach revealed the names of unvaccinated staff members in a group email.

The Canadian health care facility, the Ottawa Hospital, said in a statement that it apologized to staff about the email, which was intended as an invitation for unvaccinated employees to complete a COVID-19 vaccine education session.

Hospital staff
A hospital in Canada has apologized to staff after sending an email that inadvertently revealed the names of unvaccinated employees. Above, medical staff in the intensive care unit of the Centre Hospitalier Universitaire in Pointe-a-Pitre, on the French Caribbean archipelago of Guadeloupe, on September 3. Getty Images

The system-generated email was sent on September 8 from the hospital's human resources department. According to CTV News Ottawa, the letter was sent to "employees who have declined the COVID-19 vaccination," and it included staff email addresses in the "To" section and not as blind carbon copies.

"This past week, an email was sent from one of our software systems to a list of unvaccinated staff members, inviting them to complete a vaccine education session. The staff names were unfortunately visible," the Ottawa Hospital said in a statement.

"The email was immediately recalled and all copies were deleted. An apology and explanation was sent to the staff members affected. The Ottawa Hospital's Information and Privacy Office investigated the matter and reported it to the Information and Privacy Commissioner," the statement said.

The president of the Canadian Union of Public Employees (CUPE) 4000, which represents staff members at the hospital, told the Ottawa Citizen that some of the people whose names were leaked were angry about the breach.

"People were reluctant first of all to give their information [about vaccination status] because they weren't sure where it was going to be stored," CUPE 4000 President Lou Burri told the paper. "A lot of employees are upset and they are going to dig in. This made things worse, for sure."

The Ottawa Hospital has said all its employees must have received at least the first dose of a COVID-19 vaccine by September 7, followed by the second dose by October 15.

Dr. Kieran Moore, chief medical officer of health for Ontario, released a statement on August 24 when the Ottawa Hospital first announced its COVID-19 vaccine policy for staff members.

"As we head into the fall, protecting health-care workers and their patients is a top priority to ensure the safety of our population," Moore said in the statement. "The Ottawa Hospital is one of the largest academic acute care hospitals in the province and it is essential that everyone working in that environment be protected from COVID-19. Decisions like this will ultimately help us get through the COVID-19 pandemic."

The Ottawa Hospital has around 10,000 employees, of which about 390 are unvaccinated, Burri told the Citizen. He said those workers who are not inoculated would have preferred personal communication regarding the education session rather than a group email.

"Needless to say, people were reluctant to get the vaccine in the first place and this just threw a big curveball in," Burri said.

Newsweek contacted the Ottawa Hospital for comment but did not hear back in time for publication.