Personal Health Information at Risk in Ontario Incidents

According to a recent newspaper report, a doctor from the Hospital for Sick Children (Hospital), one of Canada's leading hospitals located in Toronto, while traveling to a medical conference via Toronto's Pearson International airport, lost an external hard drive containing the personal health information of 3,300 patients. The patients had all received eye examinations or treatments at the Hospital. The information on the hard drive included patients' names, dates of birth and diagnoses, but did not contain Ontario Health Insurance Plan (OHIP) data, or telephone and social insurance numbers. The recent loss followed only months after the theft of a laptop from another physician at the Hospital, a laptop that had been left in a van parked in a downtown Toronto parking lot. The data involved in the earlier theft included information of 2,900 patients and, in some cases, included the patients' HIV status. That loss prompted Ontario's Information and Privacy Commissioner (Commissioner), acting under the Personal Health Information Protection Act, to order the Hospital to adopt a policy that "prohibits the removal of identifiable PHI [personal health information] in any form from the hospital premises." Additionally, any personal health information in electronic form that needed to be removed from the premises must be encrypted. A spokesperson for the Hospital said the Hospital has been working with the Commissioner for several months to educate staff and is close to having all information systems properly encrypted. For the newspaper article from the Toronto Star, see: http://www.thestar.com/living/article/251904 For the full text of the order issued by the Commissioner, visit: http://www.ipc.on.ca/images/Findings/up-ho_004.pdf For a news release issued by the Commissioner relating to the earlier incident and the order, see: http://www.ipc.on.ca/images/Resources/up-2007_03_08_ho_004.pdf Summary by: Clare McCurley