Dozens of B.C. health‑care workers snooped on Lapu Lapu Festival victims’ medical records: OIPC report

Dozens of health-care workers accessed private information of victims of the horrific attack at Vancouver’s Lapu Lapu Day festival, a new report reveals.

A concerning report surfaced Wednesday showing dozens of health-care employees were “snooping” into the medical records of the Lapu Lapu victims.

According to the Office of the Information and Privacy Commissioner for B.C., half of the individuals who received care at medical facilities following the tragedy subsequently had their privacy breached.

The tragedy occurred on April 26, 2025, when an SUV drove through the Lapu Lapu Day Festival in Vancouver, killing 11 people and injuring more than 30 others

The report outlines that there were 71 snooping incidents on the medical records committed by 35 employees of Vancouver Coastal Health Authority, the Fraser Health Authority and the Provincial Health Services Authority.

The investigation also found that there was a report found at Providence Health Care of an assistant at a physician’s office who had access to an FHA electronic medical-records system.

“It was curiosity that really, drove them to be snooping on these records,” said Michael Harvey, the information and privacy commissioner for B.C.

CTV News has learned that a total of 26 PHSA staff were found to have engaged in privacy breaches.

PHSA explained in a statement that disciplinary action ranged from formal reports to professional licensing bodies—where applicable—to written warnings, suspensions and terminations.

Fraser Health reported that, following an investigation, seven staff members had inappropriately accessed the medical records of four patients involved in the Lapu Lapu Festival tragedy.

Vancouver Coastal Health says it confirmed four staff members.

The consequences were similar among the three heath authorities.

The commissioner’s report also said it examined whether the health authorities had reasonable safeguards in place to prevent snooping, and found that despite the breaches that took place, the health authorities had the expected safeguards in place and are working to strengthen them.

The commissioner released several recommendations to strengthen security to help ensure this doesn’t happen in the future, which can be found online.

Filipino BC responds

Filipino BC board Chair, RJ Aquino, spoke to CTV News hours after the report was released and said he was just learning that the Lapu Lapu Festival victims had their medical records breached.

He called the findings “disappointing” and questioned whether the victims privacy was a priority, especially with the heightened attention after the attack.

“It’s just retraumatizing them,” said Aquino.

“We want to make sure that not only is their privacy protected, but that they have the reassurance that the system, and all of its forms is set up in a way to be able to protect and take care of them.”

Aquino is hopeful that this will make change and future patients will be protected.