[Med-privacy] Health records sold at public auction (Canada)

[Peter Marshall]

http://www.canada.com/vancouversun/news/story.html?id=512bec85-3609 
-4610-83da-8c6e2885e6f6&k=28942

Monday  March 6  2006

Health records sold at public auction
B.C. government tapes contain information on conditions such as HIV
status, mental illness

Jonathan Fowlie
Vancouver Sun

Saturday, March 04, 2006

CREDIT: Stuart Davis, Vancouver Sun
Labour Minister Mike de Jong has ordered an investigation into the sale  
of
these computer tapes containing private health information.

The provincial government has auctioned off computer tapes containing
thousands of highly sensitive records, including information about
people's medical conditions, their social insurance numbers and their
dates of birth.

Sold for $300 along with various other pieces of equipment, the 41
high-capacity data tapes were auctioned in mid-2005 at a site in Surrey
that routinely sells government surplus items to the public.

Included among the files were records showing certain people's medical
status -- including whether they have a mental illness, HIV or a
substance-abuse problem -- details of applications for social  
assistance,
and whether or not people are fit to work.

"This should never happen," Mary Carlson, director of the Office of the
Information and Privacy Commissioner of B.C., said Friday in an  
interview.

"There are dignity issues involved in a lot of these disclosures," she
said, pointing to things such as HIV status and a need to apply for  
social
assistance.

In an interview Friday afternoon, Labour Minister Mike de Jong, whose
ministry oversees the auction process, said he has ordered an immediate
investigation to determine how the breach took place.

"It is completely unacceptable for information like this to be unsecured
in the way this clearly is," he said.

"People deserve to know [this] type of information . . . is secure and
kept private," he added, offering an apology. "I can think of no excuse
for information of this sort finding its way into the public domain."

In addition to the records containing social insurance numbers and  
medical
conditions, there were also hundreds of what appeared to be caseworker
entries divulging extremely intimate details of people's lives.

One of those entries details a letter from a woman whose daughter was
sexually abused, which provides the woman's name.

"Re: her daughter . . . sexually abused by a tenant living in the  
basement
of her house," said the entry, which was logged in 1996. "No mental
handicap . . . RCMP involved."

Because of the sensitive nature of the information, The Vancouver Sun  
will
not publish any details that would directly identify any of the people
involved.

Another entry, which included the person's name and phone number,
contained the following.

"Wants to recover back pay from MSS because she did not know she had to
have a Dr.'s note . . . was beaten by her boyfriend . . . wanting for
money from WCB but in the meantime wants to pay her bills."

Among the other files there was also a document containing more than
65,000 names along with corresponding social insurance numbers,  
birthdays
and what appeared to be amounts paid to each person for social support  
and
shelter.

The files on the tapes appear to have been created between 1995 and 2001
and appear to have come from the Ministry of Human Resources and the
Ministry of Social Services.

The person who bought the reusable tapes says he intended to sell them  
as
blanks for a profit, and only recently discovered they were filled with
information. He gave the tapes to The Vancouver Sun out of concern that
other information might not be properly destroyed, and did so on the
condition of anonymity.

On Friday, De Jong could not say exactly what happened, but said there  
are
standards in place and that he wants to find out immediately what went
wrong.

"I want ministry officials to work closely with the privacy commissioner
to do what can be done now to retrieve and secure the information and  
also
to begin an exhaustive examination of how this happened," he said.  
"There
are a strict set of guidelines that are in place governing the storage  
of
information and also governing the disposal of assets."

A technology product specialist with Grand and Toy Technology said  
Friday
most private industry will not sell backup tapes or any other removable
media, but rather will go to great lengths to ensure the data completely
disappears.

"Depending on what the organization requires, we can have the tapes
crushed, or we can have them crushed and burned," said Brent Wilson.  
"It's
a certified process."

Carlson also said the government had sold sensitive information to the
public once before, but that the details of that case had not been made
public.

She added that she is "disappointed" to hear it has happened again.

"There is a positive duty in law both for government agencies and  
private
sector entities," she said.

"It requires them to pay attention to secure disposal of information.  
You
can't just sell things. You can't throw things in the garbage or in
dumpsters. You have to take steps to make sure that information is
scrubbed off."

jfowlie@png.canwest.com
  The Vancouver Sun 2006

Copyright 2006 CanWest Interactive, a division of CanWest MediaWorks
Publications, Inc..