Eastern Health calls cops after patient medical info posted on Facebook

Eastern Health says it has called in the police after being made aware of a "breach of privacy by a member of the public" who posted on Facebook what appears to be information from other people's medical files.

The health authority says it is contacting everyone affected, and has also reported the breach to the province's privacy commissioner.

Eastern Health steered further inquiries to the Royal Newfoundland Constabulary, which did not immediately return a message seeking comment.

The breach relates to pictures posted on the social media site Feb. 9.

They include a form with the MCP number, address and detailed medical information — including prescriptions and test results — of a named person.

A series of screenshots show the names of about three dozen other apparent patients in a file directory.

"This is only a small sample of what I have," the person posted.

CBC

CBC News is not identifying the Facebook account in question, in an effort not to further breach the patients' privacy.

The posted records appear to be about 10 years old.

Less than two hours after being contacted by CBC News, Facebook removed the post.

A Facebook spokesperson said that posting personal or confidential information about others without prior consent is against the company's policies.

Facebook said it will continue investigating.

Privacy commissioner alerted by public

The privacy commissioner's office said it received a call from a member of the public on Monday, a day after the post went online, alerting them that the information was there.

"We contacted Eastern Health and they were aware of it as well, and they were just assessing the situation," said Sean Murray, the director of research and quality assurance with the privacy commissioner's office.

Murray said the province's privacy laws "are not really designed to deal with this type of situation."

We don't have any authority to knock on this person's door, or order them to take the information down off Facebook. - Sean Murray 

Even though the pictures posted online contain personal health information, the Newfoundland and Labrador act only applies to custodians of personal health information —  regional health authorities and health professionals, for example. 

"It doesn't apply to a private individual out there who may have gotten their hands on this information somehow," Murray said.

"So we don't have any authority to knock on this person's door, or order them to take the information down off Facebook, anything like that."

Murray said the affected patients could consider contacting a lawyer, to potentially pursue a civil remedy to sue the individual for damages, or to try to get a court order to have the information removed.

"But that's not easy for people to take on," Murray said.

Meanwhile, the privacy commissioner's office wants to know how this person obtained the medical information, and when.

"We'll be continuing to maintain contact with Eastern Health on this, and hopefully we can learn something about how this occurred in the first place, and try to prevent it from happening (again)," he said.

Read more from CBC Newfoundland and Labrador