Lost and dumped medical records spark privacy investigation

B.C.'s Information and Privacy Commissioner has launched an investigation into two incidents involving government medical records that were lost in one case, and found dumped in the trash in the other.

"The first breach involves the loss of an unencrypted laptop at the Toronto airport containing the personal information of 450 patients of the Vancouver Coastal Health Authority," said the statement issued by the office on Wednesday morning.

According to media reports, the records were lost by a VGH doctor who was conducting quality control research, but he did not report the loss until 10 days later.

"I am deeply concerned that sensitive personal information may not have been encrypted on a mobile device," Information and Privacy Commissioner Elizabeth Denham said in the statement.

"In 2005, we issued guidelines that made clear that electronic records containing personal information should always be encrypted when in transport," she said.

Records found in dumpster

"The second involves the disposal of Ministry of Children and Family Development records in a dumpster behind a Saanich apartment building last week," the statement said.

According to CTV News, it is believed the the papers, which contained the names, addresses, birth dates and health card numbers of clients, were dumped by a former government employee who left government several months ago.

"British Columbians have a right to expect that ministries and health authorities will take all reasonable steps to protect their personal information," said Denham.

Concerns remain about privacy

In question period in Victoria on Tuesday New Democrat MLA Doug Routley blamed the government for the privacy breaches.   

"For some reason, when it comes to the public's privacy, it all ends up in a dumpster," said Routley.

But Health Minister Mary Polak says most of the items in the dumpster were training manuals and there were personal records of only five families.

"Those people were immediately informed, save one family who moved out of British Columbia. We have not been able to locate them," said Polak.

But that still worries the assistant privacy commissioner, Catherine Tully.

"We are always deeply concerned with the possibility sensitive personal information may not have been properly protected," said Tully.

The investigations will look at the causes behind the breaches and determine whether each of the public bodies has:

• Taken adequate steps to contain the breach.
• Properly evaluated and addressed the risks associated with the breach.
• Notified affected individuals as appropriate.
• Developed a comprehensive plan to prevent any similar future breaches.