Report on 2021 break-ins at Hay River, N.W.T., hospital recommends switch to electronic records
A report from the N.W.T.'s information and privacy commissioner about two apparently related break-ins at the former Hay River hospital building three years ago recommends the health authority move toward electronic records.
During the early morning hours of June 16, 2021, someone broke into the H.H. Williams Memorial Hospital and stole two cheques with client names on them, some electronics and petty cash. They also stole keys to the Social Services vehicle.
The Hay River Health and Social Services Authority initially said no client records were stolen. It issued another statement a few days later, saying there had been another break-in and there may have been a privacy breach.
During the second break-in, on June 20, 2021, someone used an ice scraper to force open the door to the file room that contained personal information from 1,095 people.
In his report released Tuesday, commissioner Andrew Fox said the two break-ins that month were considered to be related and investigated together by police. Fox recommended that the local health authority review its security needs and that it acquire and maintain privacy protective equipment and file storage.
"If records had been stored in a secure electronic system, the breach would have been prevented," the commissioner wrote.
"While electronic records management systems are not a panacea for privacy breaches, they can offer significant improvements in security," Fox wrote.
The former hospital, operated by the Hay River Health and Social Services Authority, served as a Child and Family Services office at the time.
Although no files were identified as missing after the break-in, some of the lockable cabinets had been overturned and their drawers had been emptied.
The Social Services vehicle was also stolen, and police later found it near another community with the keys inside.
'Property theft, not information'
The building was mostly vacant when both thefts happened and several offices had been moved to another location. The building was set to be demolished later that year.
"The circumstances suggest the purpose of the break-ins was property theft, not information," Fox wrote.
Fox said some of the health authority's security measures in the building were out of date.
"The security measures in place were insufficient to prevent unlawful entry," he said.
"Times change. Security measures need to be reviewed on a regular basis to ensure they are appropriate for the circumstances."
The commissioner also noted that the only security measures taken after the first break-in were to fix the main doors and put double locks on them.
Of the files in the room that was broken into, 65 were considered active. Staff called to all 65 people, but only 10 could be reached, so they did a community-wide mail-out to notify people of the potential breach.
Fox said the file room break-in could have resulted in a serious breach.
"Although this privacy breach could have caused significant harm, the circumstances suggest that the likelihood of harm is low."
