Privacy and security
Health records lost en route to
– B.C. Information and Privacy Commissioner David Loukidelis (pictured) is
investigating the loss of four magnetic data tapes that contain the
health information of 130 British Columbians.
According to a report in the Victoria Times Colonist newspaper, the
unencrypted tapes were sent to the B.C. Health Ministry by its
counterpart in New Brunswick via courier in early October. They never
reached the B.C. ministry.
Loukidelis said he was “appalled that health information is being
transmitted in such an insecure way.” The tapes were shipped as part of
a billing arrangement between the provinces. The records of 130 British
Columbians who had received medical services in New Brunswick were
included, as was the data of 480 New Brunswick residents who had been
treated in B.C.
Information on the tapes includes names, medical services plan numbers,
birthdates and possibly some description of services rendered and the
costs of those services, said B.C. Health Minister George Abbott.
Loukidelis said all such data that is transported should be encrypted,
so that no one unauthorized can access it.
“It just, on the face of it, doesn’t meet the bar of what’s required
under the legislation to take reasonable measures to protect personal
information,” Loukidelis told the Times Colonist. “Meaningful, proper
encryption is something that has to happen here.”
Loukidelis said he has received assurances from the Health Ministry that
it will only transport encrypted data from now on. The ministry has also
assured him that all those whose data has been lost are being contacted
and offered a credit-watch service.
There is no evidence the tapes, shipped by a courier, have been stolen.
“At this time we’re certainly operating on the basis that they are
missing and steps need to be taken – regardless of whether these tapes
are found – to do a better job, frankly, of transferring this
information across the country,” Loukidelis said.
The privacy commissioner said large organizations that handle a
significant volume of personal data will never be able to provide
perfect security. “But at the same time you’ve got to devote every
reasonable effort to make sure that you’re doing things according to the
law and, I think, according to reasonable expectations in the industry
and on the part of the public.”
Abbott said his ministry has been trying to piece together a chronology
of what happened to the tapes. He said his ministry has no record of
being advised by New Brunswick that the tapes were on their way.
Abbott disputed claims made in New Brunswick that the reason the tapes
weren’t encrypted was that B.C.’s ministry isn’t capable of reading such
tapes or CDs. “We don’t believe it to be accurate,” he said.
Abbott said B.C. sends and receives encrypted data through an agreement
with Saskatchewan. “We have been working with New Brunswick since the
early summer of this year to switch over the files from mainframe
cartridge to encrypted CD,” Abbott said, adding that, as of last Friday,
the two provinces switched over to sharing only encrypted data.
“Unfortunately, probably one of the last shipments that didn’t involve
it has gotten lost.”
Asked why the fact the tapes were lost hasn’t been made public until
well after the incident occurred, Abbott said: “That’s a very good
question and I know the commissioner is concerned about that, I’m
concerned about that, my deputy’s concerned about that and we need to
get some better answers around why there wasn’t more timeliness in terms