TORONTO - Ontario's information and privacy commissioner has launched an investigation after the health information of more than 83,000 people who attended H1N1 flu clinics in Durham Region, east of Toronto, was apparently lost.
A health department nurse was taking a USB key containing the records to her car in Whitby, Ont., to take it to a remote clinic site on Dec. 15 when the device was lost. A search failed to turn it up.
"We believe it was lost on regional property. We have some video surveillance tape data to indicate that was the case," said Dr. Robert Kyle, chief medical officer of health for Durham Region.
The privacy commission office was advised Monday by the Durham Region health department that the device was missing, said spokesman Bob Spence.
The USB key contained the names, addresses, phone numbers, dates of birth and health card numbers of patients who attended H1N1 flu vaccination clinics in the region between Oct. 23 and Dec. 15.
The device was not encrypted, even though Ontario Privacy Commissioner Ann Cavoukian had issued guidance to all health information custodians in March 2007 that where personal health data is stored on mobile devices in identifiable form, it must be encrypted.
That guidance was issued in a health order to Toronto's Hospital for Sick Children after a laptop computer containing the personal health information of 2,900 patients was stolen from a doctor's minivan in downtown Toronto on Jan. 4, 2007.
"There is no excuse for unauthorized access to personal health information (PHI) due to the theft or loss of a mobile computing device - any PHI contained therein must be encrypted," Cavoukian said at the time.
When asked if the lack of encryption was a lapse, Kyle said that would be part of Durham Region's investigation.
The focus of the privacy commissioner's investigation will be on what happened, how it happened and what steps can be taken to prevent a similar incident from occurring in the future, said Spence.
The probe will work in co-operation with, but be separate from Durham Region's own probe, he added.
"We cannot jump to any conclusions about what recommendations may be issued in this case," said Spence, but added the commission considers the Sick Kids health order to be one of its foundation orders.
"The privacy commission is always concerned any time that personal information is inadvertently disclosed or lost," said Spence.
"This is personal health information that is very sensitive. You don't want your neighbour to know what type of operations and so on you've had."
"If somebody were to find the key, they'd need to understand what file name to look for. They'd need to know what application to use to open the file. And if they were successful in opening the file they'd see a lot of uninterpretable symbols," said Kyle.
But he added they would be able to see "clearly client name, address, phone number and health card information and family physician," he added.
Ontario's Ministry of Health was notified about the missing storage device last Friday but won't be conducting a separate investigation.
However the ministry is drafting a communication to public health units, advising them of best practices for data as it relates to mobile devices, said spokesman David Jensen.
Durham will review its privacy policies, procedures and practices, and is seeking advice on whether patients should be issued new OHIP cards, said Kyle.
It is also notifying patients by letter and taking their questions by phone.
Durham took security precautions at its flu clinics by choosing six fixed sites instead of roving clinics, information on laptops was encrypted and security guards were present at all clinics, said Kyle.
"You do your best to prevent human error but it does happen from time to time," he said.
Durham Region police are treating the case as a lost property report, said Sgt. Nancy Van Rooy.
Spence said Durham officials responded quickly to the disappearance.
"There have been times in the past where internal investigations or searches have gone on for a couple of months and the public hasn't been notified," said Spence.
Anyone with concerns or questions can contact Durham Health at 905-666-6241 or 1-800-841-2729.