Pharmacy health files found at Rankin Inlet dump, says North West Company

Sensitive health files of pharmacy patients were discovered at a landfill in Rankin Inlet, Nunavut, in February, according to a notice posted by the North West Company. 

A photo of the notice — directed to residents in the Kivalliq region — was shared on Facebook. It states the records belonged to patients at the previously known Sakku Drugs. The North West Company — which operates NorthMart stores across the North — silently bought the Inuit-owned Sakku pharmacy and began running it as the Northern Pharmacy in February, as reported by Nunatsiaq News. 

The files discovered at the dump included patient names, health card numbers, dates of birth, prescribed medications and where they reside, according to the notice. 

A community member found the files and alerted the company, states the notice.

At best we can determine ... no other individual has viewed any records at all.- North West Company's emailed response

"Immediately upon learning that sensitive health materials were located at the landfill, Northern Pharmacy deployed staff to retrieve [them]," states the notice, which is not dated.

The files were retrieved on Feb. 28, placed into "secure storage," the company stated.

The company said its own privacy officer determined a privacy breach had occurred as the files were in a public location. 

Residents' privacy 'top of mind': company

The North West Company declined an interview with CBC News, but a spokesperson gave a written response.

The company follows federal and territorial laws, and has "best practices" to protect personal health information, the email states. 

"Our pharmacies maintain records with the health, safety, and privacy of residents top of mind," wrote North West Company spokesperson Derek Reimer. 

"At best we can determine, other than the individual who discovered the records, no other individual has viewed any records at all."

The company said the sensitive files were found in boxes with no labels indicating it held personal health information.

It says it "promptly informed" both Nunavut and Canada's information and privacy commissioners after the breach.

CBC contacted the territory's privacy commissioner for comment, but had not received an answer as of Thursday afternoon.

Full review of policies completed: company

In its notice, the company says it has several security measures in place to prevent privacy breaches:

Some of them include:

• All confidential information is securely stored in units that are clearly labelled.
• The information is stored in locations that aren't accessible to the public.
• Personal health information is retained and destroyed, according to the company's policies.
• Pharmacy managers received privacy training in January this year at an annual conference.

After the breach, Reimer said the company did a full review of its policies within its community pharmacies. 

"All employees are accountable to protect the privacy of residents," said Reimer. "We are committed to preventing future breaches."