N.W.T. privacy commissioner to investigate 'major breach' of health data found at dump

The Northwest Territories' privacy commissioner says she will investigate what she calls a "major breach," after CBC reported that a man has found hundreds of confidential medical records at a dump.

The documents found in Fort Simpson, N.W.T., contain detailed information about patients' mental health and history of drug use, including applications to addictions treatment facilities, progress reports from those facilities, and detailed notes from one-on-one counselling sessions.

The files also included social insurance, treaty and health card numbers.

"[These are] clearly very sensitive documents and they shouldn't have been out there," said Elaine Keenan Bengts, the N.W.T's information and privacy commissioner.

On Friday, Keenan Bengts said she knew very little about the situation. But she said it, and the stolen laptop breach this past summer that she's still investigating, constitute as "major breaches."

"These sorts of breaches are problematic," she said. "These big ones should never happen."

Keenan Bengts said she got a call from the Northwest Territories Health and Social Services Authority on Thursday afternoon, notifying her of the breach.

She said she will now undertake a review — tackling questions of how it happened, why it happened and how it can be prevented in the future.

Keenan Bengts said the territorial government has clear policies on how to store and destroy personal health records.

"Clearly somebody didn't follow protocol, if these documents came from a either a public body or a health institution," she said.

Keenan Bengts said she wrote to Randal Sibbeston, who discovered the files, asking him to hand over the records as evidence for her review.

Sibbeston, who was still in possession of the documents as of Friday afternoon, told CBC News he intends to hand them over to the privacy commissioner.

Keenan Bengts added that if individuals find documents like these, they should be handed over immediately to the department, local clinic or the RCMP, because they contain sensitive information.

Psychologist says 'that's horrible'

"My initial thought was that's horrible," said Hiedi Yardley, a registered psychologist who runs a private practice in Hay River, N.W.T., when asked about the discovery.

Yardley said she's concerned that people would perceive that counsellors and therapists in the N.W.T. aren't keeping clients information safe.

"A finding like this, and it being very public, could create an issue of trust in the profession," she said.

Yardley said her office keeps any client information stored in a locked cabinet, in locked rooms. Information isn't shared with anyone, unless there's client consent, she added.

"I would say most therapists — I can't speak for everybody — but we are bound legally and ethically by confidentiality, and that includes the storage of our records," she said.

"We take it pretty seriously, and I hope that this does never happen again."

Yardley says if people are concerned, they should consult their doctor or counsellor and ask how their personal information is documented and stored.

Client privacy taken 'very seriously,' says authority

The territory's health department has a history of patient privacy breaches.

Most recently, a laptop was stolen from an employee's locked car in Ottawa, affecting up to 80 per cent of N.W.T. residents' health records.

Between April 2016 and March 2017, the information and privacy commissioner investigated eight files under the Health Information Act, including three breaches of patient data.

A USB stick with 4,000 patient records was temporarily lost in 2014; in 2010 and 2012 medical records were accidentally faxed to CBC.

Julie Green, MLA for Yellowknife Centre, said on Friday that she asked Health Minister Glen Abernethy to investigate why the documents were in the landfill. She wants him to report back to MLAs and the public, and inform the people whose data has been breached.

"I think there is confidence in the health records system, but there have been a number of privacy breaches," said Green.

"I think that people are aware of those and they're concerned about them."

The health minister has committed to fulfilling those requests, she added.

The Northwest Territories Health and Social Services Authority published a Q&A after CBC News ran the story on Friday.

"Our first priority is to recover these records," said the authority, which added that it's asking the Fort Simpson man to return the files "to prevent further breaches."

The authority says it takes the privacy of residents "very seriously."

It says it will contact the individuals impacted by the privacy breach after it retrieves and assesses the documents. It warns that it may not have answers for residents who contact the authority with questions, until after the investigation.