450 medical records lost in privacy breach
The medical records of 450 people have been compromised after a laptop and a USB drive containing personal information were lost by a medical student.
Carolina Becerra received a letter from Vancouver Coastal Health dated Oct. 6 stating that her hospital records from Vancouver General Hospital went missing while the computer was being used outside of its facilities – but the agency downplayed the idea someone could use the information.
"We have no reason to believe that the information contained on the devices would be used for any malicious purposes," Chief Privacy Officer Steven Tam wrote.
The health agency said it was "troubled" to learn about the loss and said the electronics "likely contained" Becerra's name, medical record number, date of birth and medical diagnosis. The lost information was for visits to VGH between Nov. 16, 2009 and March 2010.
The agency said it was important to tell her of the loss so she could protect herself "against any form of identity fraud."
Becerra was very troubled by the letter and felt the agency wrongly downplayed the security breach.
"It's like it's no big deal. Your information is lost and we don't know where it is -- but don't worry about it. We don't think it will be used for any malicious purposes. How do you know?" she said.
Gavin Wilson of Vancouver Coastal Health calls the breach "unfortunate."
"We're upset as well. It's unacceptable that patient privacy is violated in that way and we're going to do our best to see that this doesn't happen again," he said.
The laptop and drive were lost at the Toronto airport while the resident physician was travelling and they were likely stolen, Wilson said.
The resident waited 10 days to tell the health authority what happened, Wilson added. He has been given a verbal warning.
"Sometimes there's just human error and in this case that's what happened," Wilson said.
Wilson said he can't guarantee the incident is isolated, saying that there are many people in the medical field using laptops and the agency is "struggling a bit" to keep on top of new mobile health technology.
"This is the way physicians and other health care workers need to do their job. They need to use these devices," he said. "The issue is keeping the information of our patients confidential and safe and we still believe that can be done."
The lost information was password protected but not encrypted.
Health Minister Mike de Jong said he's troubled that there was a long delay before provincial privacy officials were notified of the incident.
"That's not consistent with the protocols. But let's be clear also, this is an accidental situation," he told CTV News.
De Jong said he's still finding out why the delay occurred, but he suspects it may be because the individual was hoping to find the laptop.
"But the moment information goes missing or an instrument goes missing there's an expectation and a requirement to notify us [so] that we can begin the protocols of notifying people," he said.
Becerra said she's canceling her credit cards and is filing a police report. She's also written a letter of complaint to both Vancouver Coastal Health and the B.C. Privacy Commissioner to get some answers.
'What are they going to do in the future to make sure that this doesn't happen? [Because] it just seems really unprofessional to have information like that floating around," she said.
Becerra said the incident is "kinda scary."
"I don't like to have my information floating around on somebody's laptop in their car."
In 2006, a computer went missing from the office of the Employee and Family Assistance Program (EFAP), run by the Vancouver Coastal Health Authority.
The computer contained personal information and referral information for thousands of health workers who sought help for "intensely personal problems," including drug and alcohol problems, sexuality issues and emotional trauma.
With a report from CTV British Columbia's Lynda Steele