Health records found at Fort Simpson dump may have been stolen: report
Privacy commissioner releases findings after resident claimed to find hundreds of files at dump
The Northwest Territories' privacy commissioner's investigation into medical records allegedly recovered at the Fort Simpson landfill in 2018 point to someone stealing the files from a health and social services building in the community.
CBC North first reported on the hundreds of health records found at the dump in December 2018, when a local Canadian ranger, Randal Sibbeston, said he found the records in a bankers box at the salvage area.
Elaine Keenan Bengts's report, dated March 2020, says there were 124 file folders in the box that they recovered, which contained surnames starting with the letters "A" through "S." Most were dated between November 1988 and January 2005.
She said the contents mostly related to addictions counselling services, including referrals and discharge papers to various residential addiction programs.
"In addition to first and last names and contact information of individuals," the report says, the files also contained personal information such as:
- Date of birth.
- Social insurance, treaty and health-care numbers.
- Personal history, including family, legal, health, addictions and treatment history.
From letterheads and logos, Keenan Bengts found the records were created by several organizations, including the "Alcohol and Drug Program for the Hay River Reserve," the "Sharing Lodge Healing Program" and the government of the Northwest Territories.
She said it is "impossible" to ascertain where the files originated, but the evidence points to non-government organizations that supported addictions counselling in the N.W.T.'s Dehcho region, including on the Hay River Reserve.
Since those programs were supported by the federal government or the territorial government, Keenan Bengts says it "suggests ownership [of the records] rests or has rested" with the Department of Health and Social Services, the Dehcho Health and Social Services Authority and the Northwest Territories Health and Social Services Authority.
Getting documents required RCMP's help
Keenan Bengts said the RCMP had to intervene to recover the box from the resident who found it (the report calls him "A.B."), because he refused to turn it over unless he could get a meeting with the territory's health minister.
She also noted that what was recovered looked different from the files shown in the CBC's coverage.
"There is some question, therefore, as to whether the box received by the Office of the Information and Privacy Commissioner is the same box in which the records were allegedly found," the report said.
Keenan Bengts said A.B. claimed what he turned over was only a portion of what he found, saying there were "thousands and thousands" of files still at the landfill.
He said "he only retrieved some of the records he had found and that the files at the dump were 'two or three feet' deep, 'trucks' deep, and 'ten feet to fifteen feet deep in diameter,'" the report said.
He ultimately provided written confirmation to the privacy commissioner that he had turned over all the files in his possession and had not made copies.
How it happened
The report indicates that investigators concluded the files may have been stolen.
The report says the files "most likely" had been stored in the basement of a health and social services building (called SISH) in Fort Simpson. There was full public access to the building, which wasn't locked when investigators visited it.
"This breach suggest[s] that it is very possible that the files were not found in the dump as is alleged by A.B. but were taken from" the building in Fort Simpson during either a major cleanup, a flood in the basement, or when a boardroom was converted into office space — all of which happened in 2018.
The security in the building "was at best weak and, at worst, non-existent at the time of the breach," the report reads.
"I find that there were virtually no administrative, technical or physical safeguards in place for the protection of the records being stored in the basement of the SISH building at the time the records went missing."
COO of health authority 'did nothing'
A.B. also contacted his MLA about finding the records, the report says. The MLA then brought the issue to the chief operating officer (COO) for the Dehcho Region's Health and Social Services Authority, who said he was "confident" there was no way that A.B. could have accessed the records, due to their security.
The report says the COO took no steps to investigate the matter further, which was required by policy.
"It is glaringly clear that the COO had no depth of understanding as to his responsibility for the records under his custody and control, nor consideration as to the seriousness of the reported breach or the possible consequences of it," it reads.
"He took little to no notice and shrugged off the report from the MLA. He did nothing."
Further, the report says the N.W.T. Health and Social Service Authority's "initial response to the breach was a non-response."
"Even after the discovery of the breach, it does not appear that any significant or obvious steps were taken to better secure the records remaining in the SISH basement storage," it says.
Keenan Bengts said it is possible that A.B. found the files at the dump, possibly after the storage area was cleaned out.
"It is also possible that A.B. simply took a box of files from SISH when they were left in the porch or the foyer of the building during one of these two clean outs," the report said.
The CBC has reached out to Sibbeston for comment, as well as the N.W.T. Health and Social Services Authority, in response to the recommendations and comments about its chief operating officer.
Among her recommendations, the privacy commissioner said the N.W.T. Health and Social Services Authority needs to review and inventory all stored materials in its custody, particularly at the Fort Simpson facility, noting there were "a lot of failures" on the part of the authority.
She recommended that "urgent steps be taken to develop or actively adopt system wide policies" around the retention, transfer, storage and destruction of records.
Keenan Bengts also said few of the N.W.T. health authority's employees had received "even the basic level of privacy training required" under its mandatory training policy. She said all chief operating officers and senior managers should complete the privacy training that is available through the health department.
"This breach has also brought to light the very real possibility that there are many more similar records sitting around in neglected storage areas throughout the Northwest Territories, ripe for a similar breach to occur."
Read the privacy commissioner's report in full here:
(PDF KB)
(Text KB)CBC is not responsible for 3rd party content