Were private medical files that ended up on Facebook found on public parking lot?
Eastern Health is responding to concerns raised by a client whose privacy was breached earlier this year, and disputing claims by the person who posted confidential medical data on Facebook outlining how he obtained the information in the first place.
That man recently told a judge that the private files were on a memory stick he picked up nearly two years ago in a very public place — the parking lot of a St. John's hospital.
Eastern Health declined CBC News interview requests, but in a written statement called his claim "unsubstantiated."
The privacy problem began in early February, when that Facebook user posted information from other people's medical files on his social media page. The files appeared to be about a decade old.
The health authority told CBC News in April that an investigation did not identify the source of the breach.
This month, Eastern Health responded to followup questions by saying it has been aware of the memory stick claim since early in its investigation.
"It would not have been possible for information to be viewed or removed from an Eastern Health memory stick found in 2018 as they are all encrypted," the health authority wrote.
Eastern Health said its investigation found that a personal iPad was stolen from a vehicle in 2010 that could have contained the released data.
The memory stick allegations from the person who posted the files on Facebook came out in court last month, when the health authority won a permanent injunction barring the patient records from ever being published again.
'Better lines of communication' needed
Meanwhile, a woman whose medical information was caught up in the breach is critical of how the health authority has handled the situation, saying she has mostly been kept in the dark.
"They should have really just kept updating people on what's going on," Jane Doe told CBC News.
"There should have been better lines of communication.… If they kept the lines of communication open I might feel safer."
CBC News has agreed to grant anonymity to Jane Doe, because using her real name would reveal personal medical information, and could affect her financial and employment prospects. She also fears retaliation from the man who posted her private data on Facebook in the first place.
Jane Doe told CBC News she was unaware of his claims that her medical files were among those on an unencrypted memory stick picked up on the ground outside the Health Sciences Centre.
"That makes me a little more angrier — just knowing, if that's true, that it was found on the parking lot," she said.
In its statement, Eastern Health said the information in question was collected about 10 years ago and current policies and practices have been updated since that time to safeguard information.
"We apologize for this breach of privacy and assure patients that we will do everything possible to prevent such an occurrence in the future," the health authority wrote.
"We are sorry to hear that patients feel they were not kept in the loop throughout this process and will work to provide regular updates throughout these investigations."
Cystic fibrosis patients affected by breach
CBC News did not identify the Facebook account in question or the person behind it, in an effort not to further breach the patients' privacy.
In February, Facebook initially declined to remove the information, despite repeated requests from health officials, and took action only after receiving inquiries from CBC News.
According to a letter later sent to Facebook by Newfoundland and Labrador's privacy commissioner, screen captures containing 111 files of 34 identifiable individuals were posted in total. The file names were the names of patients who attended a cystic fibrosis clinic in St. John's.
Eastern Health went to court in February, and won a temporary injunction blocking further disclosures of the files.
The COVID-19 pandemic delayed a scheduled hearing to make the ban permanent until September.
At that court appearance, the man who posted the medical files said he had a long-running conflict with Eastern Health officials.
He said he found the unencrypted memory stick on the parking lot of the Health Sciences Centre after being escorted out of the building by security guards in late 2018.
The man told the judge he has since deleted all the information, turned over the original memory stick to an RNC officer, and would abide by any injunction ordered by the court.
Meanwhile, he is facing a criminal charge of extortion, in relation to alleged interactions with Eastern Health staff weeks after the initial privacy breach.