Tuesday, May 14, 2024
ADVT 
National

Privacy commissioner rules Medicentres failed to protect info on stolen laptop

Darpan News Desk Canadian Press, 29 Aug, 2014 11:43 AM
    Alberta's privacy commissioner says a chain of medical clinics failed to protect patients' health information on a laptop that was stolen — and took too long to publicly report the theft.
     
    The commissioner's office released its report Friday into the breach, along with several recommendations for Medicentres Inc., including one that the company update its notification policy.
     
    An information technology consultant who had taken his laptop from work lost it at a public venue on Sept. 26, 2013. Nine days later, when the laptop couldn't be found, the company reported the theft to police and the privacy office.
     
    The company didn't tell the government or the patients and their doctors until January.
     
    The laptop contained key information from about 621,000 patients, who had been seen by doctors at the company's Alberta clinics dating back to May 2011. The computer was password-protected but not encrypted.
     
    Encryption is a "no-brainer" that the privacy office has been recommending to health providers for years, said Brian Hamilton, the office's director of compliance and special investigations.
     
    In addition, he said, Medicentres failed to properly inform the consultant of its security policies and didn't conduct regular checks on his work.
     
    "This really speaks to governance and delegation of authority and being aware of what your service providers are doing," Hamilton said.
     
    The report further criticized the four months Medicentres took to inform the patients and their doctors.
     
    Disclosure wasn't mandatory by law at the time. But the privacy office had guidelines stating anyone involved in a breach should "immediately" respond and notify affected individuals. The report said staff repeatedly told Medicentres that it should notify people, but the company "spent considerable time considering and rejecting various methods of notification."
     
    Hamilton said Medicentres technically adopted the privacy office's guideline, but without a time factor, and should revise its approach to "make sure its responses are more timely."
     
    Health Minister Fred Horne said he was outraged by the delay when he learned about it. He was also angry that the privacy commissioner wasn't required to inform him about the breach.
     
    Since then, changes have been made to the province's Health Information Act that require mandatory notification of people affected by privacy breaches. Violations carry a minimum $2,000 fine for an individual and $200,000 for a corporation.
     
    Horne said details, such as how many days should be allowed for notification, are still being discussed but should be finalized in the fall.
     
    "This should never happen again," he said Friday.
     
    Dr. Arif Bhimji, chief medical officer for Medicentres, said the company needed time to pull together a team to respond to the phone calls it would receive from people about the laptop breach.
     
    Four months was "not unreasonable," he said.
     
    "I think moving forward we would try to do things sooner, but I'm assuming that we will never have this situation again."
     
    Many of the report's recommendations have already been made and others are being "worked on," Bhimji said.
     
    Medicentres has also stopped hiring consultants, he added, and will only do so again if they work strictly out of company offices with company equipment.
     
    Medicentres was recently in court asking for a stay on the release of the privacy commissioner's report and a publication ban on its contents. The judge dismissed the application.
     
    Bhimji said the company wanted more time to respond to a draft version.
     
    Court of Queen's Bench Justice Robert Graesser wrote in his decision that the company's main concern seemed to be "the potential impact the final report may have on the intended class proceedings it faces."
     
    A multimillion-dollar, class-action lawsuit against Medicentres was filed in June on behalf of patients who had their personal data stored on the laptop.
     
    Medicentres and the privacy office agree that, so far, none of the patients has fallen victim to an identity crime.

    MORE National ARTICLES

    Way To Go Flo! Alberta Athlete, 101, Wins Silver In Javelin At Seniors Games

    Way To Go Flo! Alberta Athlete, 101, Wins Silver In Javelin At Seniors Games
    SHERWOOD PARK, Alta. - Florence Storch held the javelin high with her right hand and balanced herself with the other by gripping her walker.

    Way To Go Flo! Alberta Athlete, 101, Wins Silver In Javelin At Seniors Games

    Charge Against Mountie From Jail-Sex Incident Under Review In B.C.

    Charge Against Mountie From Jail-Sex Incident Under Review In B.C.
    KAMLOOPS, B.C. - A judge wants to hear arguments from lawyers about the legality of the charge against an RCMP corporal accused of breach of trust in connection with a jail-sex incident in Kamloops, B.C.

    Charge Against Mountie From Jail-Sex Incident Under Review In B.C.

    'Simple kid' hopes PGA Tour membership does not change him

    'Simple kid' hopes PGA Tour membership does not change him
    After spending years to complete his primary mission in life, Adam Hadwin is embarking on a new one.

    'Simple kid' hopes PGA Tour membership does not change him

    Man charged with possessing child porn after items seized at B.C. home: police

    Man charged with possessing child porn after items seized at B.C. home: police
    Charges of possessing and distributing child pornography and obstructing justice have been laid against a 39-year-old Abbotsford, B.C., man.

    Man charged with possessing child porn after items seized at B.C. home: police

    Canada tops in key measures of scientific literacy

    Canada tops in key measures of scientific literacy
    Canada ranks higher than 10 other developed nations in scientific literacy, or the ability of citizens to read and fully comprehend a lengthy article about science in a newspaper, according to a report released Thursday by the Council of Canadian Academies.

    Canada tops in key measures of scientific literacy

    Parks Canada challenged in court to fold tents on lake cabin concept

    Parks Canada challenged in court to fold tents on lake cabin concept
    Lawyers for two environmental groups are going to court in an attempt to quash approval by Parks Canada of 15 proposed tent cabins at a popular lake in Jasper National Park.

    Parks Canada challenged in court to fold tents on lake cabin concept