Security on stolen laptops was inadequate: privacy commissioner

Alberta's privacy commissioner is perplexed by news that two laptops containing personal patient information were stolen from a lab at the University of Alberta Hospital.

What's surprising is the information wasn't encrypted, said commissioner Frank Work on Wednesday. "This is shocking to me.… I don't know what we have to do to drive this message home."

The computers were stolen on June 4, but news of the theft wasn't released by Alberta Health Services until Wednesday. The laptops were taken after a break-in at the Provincial Lab Information Technology room.

The laptops contained names, birth dates, personal health numbers and lab reports for communicable and reportable diseases on more than 300,000 people.

The information will be difficult to access, because of the need for several passwords to be entered, Alberta Health reports in a media release. Still, health officials warned that Albertans need to watch for any form of identity theft.

While Alberta Health Services did have layers of protection on those laptops, the final layer simply wasn't there, Work said.

"The standard in Alberta … is encryption.… This is highly sensitive information and an issue of public trust," the commissioner said. "How can the public have faith in public bodies if they can't provide security for personal information?"

The privacy commissioner has launched an investigation into the matter.

"We will be working very closely with AHS to make sure they understand their obligations and to ensure that steps are taken to prevent this from happening again, Work said.