[Dataloss] Health records on tapes sold at public auction]

[Richard Forno]

Health records sold at public auction
B.C. government tapes contain information on conditions such as HIV
status, mental illness

Jonathan Fowlie
Vancouver Sun
http://www.canada.com/vancouversun/news/story.html?id=512bec85-3609-4610-83d
a-8c6e2885e6f6&k=28942
Saturday, March 04, 2006

Labour Minister Mike de Jong has ordered an investigation into the
sale of these computer tapes containing private health information.

The provincial government has auctioned off computer tapes containing
thousands of highly sensitive records, including information about
people's medical conditions, their social insurance numbers and their
dates of birth.

Sold for $300 along with various other pieces of equipment, the 41
high-capacity data tapes were auctioned in mid-2005 at a site in
Surrey that routinely sells government surplus items to the public.

Included among the files were records showing certain people's
medical status -- including whether they have a mental illness, HIV
or a substance-abuse problem -- details of applications for social
assistance, and whether or not people are fit to work.

"This should never happen," Mary Carlson, director of the Office of
the Information and Privacy Commissioner of B.C., said Friday in an
interview.

"There are dignity issues involved in a lot of these disclosures,"
she said, pointing to things such as HIV status and a need to apply
for social assistance.

In an interview Friday afternoon, Labour Minister Mike de Jong, whose
ministry oversees the auction process, said he has ordered an
immediate investigation to determine how the breach took place.

"It is completely unacceptable for information like this to be
unsecured in the way this clearly is," he said.

"People deserve to know [this] type of information . . . is secure
and kept private," he added, offering an apology. "I can think of no
excuse for information of this sort finding its way into the public
domain."

In addition to the records containing social insurance numbers and
medical conditions, there were also hundreds of what appeared to be
caseworker entries divulging extremely intimate details of people's
lives.

One of those entries details a letter from a woman whose daughter was
sexually abused, which provides the woman's name.

"Re: her daughter . . . sexually abused by a tenant living in the
basement of her house," said the entry, which was logged in 1996. "No
mental handicap . . . RCMP involved."

Because of the sensitive nature of the information, The Vancouver Sun
will not publish any details that would directly identify any of the
people involved.

Another entry, which included the person's name and phone number,
contained the following.

"Wants to recover back pay from MSS because she did not know she had
to have a Dr.'s note . . . was beaten by her boyfriend . . . wanting
for money from WCB but in the meantime wants to pay her bills."

Among the other files there was also a document containing more than
65,000 names along with corresponding social insurance numbers,
birthdays and what appeared to be amounts paid to each person for
social support and shelter.

The files on the tapes appear to have been created between 1995 and
2001 and appear to have come from the Ministry of Human Resources and
the Ministry of Social Services.

The person who bought the reusable tapes says he intended to sell
them as blanks for a profit, and only recently discovered they were
filled with information. He gave the tapes to The Vancouver Sun out
of concern that other information might not be properly destroyed,
and did so on the condition of anonymity.

On Friday, De Jong could not say exactly what happened, but said
there are standards in place and that he wants to find out
immediately what went wrong.

"I want ministry officials to work closely with the privacy
commissioner to do what can be done now to retrieve and secure the
information and also to begin an exhaustive examination of how this
happened," he said. "There are a strict set of guidelines that are in
place governing the storage of information and also governing the
disposal of assets."

A technology product specialist with Grand and Toy Technology said
Friday most private industry will not sell backup tapes or any other
removable media, but rather will go to great lengths to ensure the
data completely disappears.

"Depending on what the organization requires, we can have the tapes
crushed, or we can have them crushed and burned," said Brent Wilson.
"It's a certified process."

Carlson also said the government had sold sensitive information to
the public once before, but that the details of that case had not
been made public.

She added that she is "disappointed" to hear it has happened again.

"There is a positive duty in law both for government agencies and
private sector entities," she said.

"It requires them to pay attention to secure disposal of information.
You can't just sell things. You can't throw things in the garbage or
in dumpsters. You have to take steps to make sure that information is
scrubbed off."

jfowlie at png.canwest.com
-- 
=