box10.gif (1299 bytes)







Privacy and security

Health records lost en route to British Columbia

VICTORIA – B.C. Information and Privacy Commissioner David Loukidelis (pictured) is investigating the loss of four magnetic data tapes that contain the health information of 130 British Columbians.

According to a report in the Victoria Times Colonist newspaper, the unencrypted tapes were sent to the B.C. Health Ministry by its counterpart in New Brunswick via courier in early October. They never reached the B.C. ministry.

Loukidelis said he was “appalled that health information is being transmitted in such an insecure way.” The tapes were shipped as part of a billing arrangement between the provinces. The records of 130 British Columbians who had received medical services in New Brunswick were included, as was the data of 480 New Brunswick residents who had been treated in B.C.

Information on the tapes includes names, medical services plan numbers, birthdates and possibly some description of services rendered and the costs of those services, said B.C. Health Minister George Abbott.

Loukidelis said all such data that is transported should be encrypted, so that no one unauthorized can access it.

“It just, on the face of it, doesn’t meet the bar of what’s required under the legislation to take reasonable measures to protect personal information,” Loukidelis told the Times Colonist. “Meaningful, proper encryption is something that has to happen here.”

Loukidelis said he has received assurances from the Health Ministry that it will only transport encrypted data from now on. The ministry has also assured him that all those whose data has been lost are being contacted and offered a credit-watch service.

There is no evidence the tapes, shipped by a courier, have been stolen.

“At this time we’re certainly operating on the basis that they are missing and steps need to be taken – regardless of whether these tapes are found – to do a better job, frankly, of transferring this information across the country,” Loukidelis said.

The privacy commissioner said large organizations that handle a significant volume of personal data will never be able to provide perfect security. “But at the same time you’ve got to devote every reasonable effort to make sure that you’re doing things according to the law and, I think, according to reasonable expectations in the industry and on the part of the public.”

Abbott said his ministry has been trying to piece together a chronology of what happened to the tapes. He said his ministry has no record of being advised by New Brunswick that the tapes were on their way.

Abbott disputed claims made in New Brunswick that the reason the tapes weren’t encrypted was that B.C.’s ministry isn’t capable of reading such tapes or CDs. “We don’t believe it to be accurate,” he said.

Abbott said B.C. sends and receives encrypted data through an agreement with Saskatchewan. “We have been working with New Brunswick since the early summer of this year to switch over the files from mainframe cartridge to encrypted CD,” Abbott said, adding that, as of last Friday, the two provinces switched over to sharing only encrypted data.

“Unfortunately, probably one of the last shipments that didn’t involve it has gotten lost.”

Asked why the fact the tapes were lost hasn’t been made public until well after the incident occurred, Abbott said: “That’s a very good question and I know the commissioner is concerned about that, I’m concerned about that, my deputy’s concerned about that and we need to get some better answers around why there wasn’t more timeliness in terms of notifications.”