Alberta’s Privacy Commissioner spoke out Thursday, after news of a laptop containing unencrypted personal information for hundreds of thousands of Albertans was stolen in September.
Privacy Commissioner Jill Clayton said she was frustrated with the theft of a laptop that had identifying information, such as healthcare card numbers, names and birthdates for 620,000 on the hard drive.
The theft reportedly took place September 26, Medicentres Canada said the laptop had been in the possession of an IT consultant in Edmonton before the theft.
While the laptop was password protected, the hard drive was not encrypted, something Clayton said should not have happened.
“We have said over and over again, don’t store personal information or health information on mobile devices, if it’s unavoidable and you have to store information on them, then make sure they are encrypted,” Clayton said.
Medicentres reported the theft to Edmonton police, and the Privacy Commissioner at the time – but Health Minister Fred Horne received a letter from the company on Tuesday, January 21, about four months after the theft.
“The reason I didn’t go public is that I can’t reveal that information, I have no ability to go public or go to the minister when someone comes to me for advice or recommendations,” Clayton said.
Legally, Medicentres did not have to report the breach – Clayton said she has pushed for mandatory reporting of such breaches in the past, and this case makes her point.
Medicentres Canada apologized for the incident, and said changes to policy have already been made.
“The primary measure we have taken is to make sure all notebook computers used either by our own staff or consultants are encrypted with a program that our IT department has approved,” Dr. Arif Bhimji with Medicentres Canada said.
Meanwhile, health critics are calling for stiffer legislation.
“We have to ensure that we use the highest level of security for encryption and for accessibility for all health information,” NDP Health Critic David Eggen said.
Changes to legislation are on Health Minister Fred Horne’s mind, but he said he would wait until results of the Privacy Commissioner’s investigation are released.
“If there’s things we can do to strengthen the Health Information Act, I’m completely there,” Horne said. “I’m pretty sure my colleagues will support me.
“But, I want to wait on the report from the Privacy Commissioner.”
Clayton said she planned to clear the schedule of an investigator to speed up the case, it’s hoped recommendations will be made in a few months.
With files from Veronica Jubinville
