EDMONTON – Alberta’s health minister said he is “outraged” after being informed on Tuesday that a laptop containing the name, date of birth, provincial health card numbers, billing codes, and diagnostic codes of 620,000 Albertans was stolen in September.
“The theft of the personal health information of 620,000 of our fellow citizens is unacceptable in Alberta’s health care system in any circumstance,” said Fred Horne.
Horne said he received a letter from the vice president of Medicentres Family Health Care Clinics informing him of the theft.
“I am extremely disappointed that it has taken this long for this to be brought to the government’s attention,” Horne said in a statement. “Albertans want to know that their information is secure and protected.”
“I’m quite frankly outraged that this would not have been reported to myself or my department sooner.”
Wednesday afternoon, Horne said he hadn’t been told where the laptop was when it was stolen, and he wants more information from Medicentres.
“I expect that the company will have many questions to answer in the next little while with respect to this.”
In a statement, Medicentres said: “Physicians and staff are dedicated to serving the needs of patients’ and meeting their health care needs in a professionally competent, friendly, caring and efficient manner. It is therefore with great regret that we are advising our patients of a potential privacy breach that affects a large number of our patients. On October 1, 2013 we were notified that a laptop belonging to an IT consultant working for Medicentres was stolen.”
Arif Bhimji, chief medical officer with Medicentres Canada says the IT consultant was working on an app at the time.
“The reason that he required this much information is that he had to test the application and that required a substantial or significant volume of patient information to be available to make sure that the application was working properly.”
“The laptop contained names, dates of birth, provincial health card numbers, billing codes, billing amounts and diagnostic codes of patients seen at Medicentres clinics in Alberta between May 2, 2011 and September 19, 2013. Approximately 620,000 patients have been affected. To date, Medicentres has no information to suggest that any of the personal information on the laptop has been accessed or misused,” Medicentres’ statement read.
Affected patients who have questions are asked to contact Medicentres directly at 780-484-8741 or via email at info@medicentres.com.
Bhimji says while most of the patient information was that of people from Edmonton and Calgary, information about patients across the province was on the laptop.
Medicentres also indicated it has implemented some additional security measures and is looking at its security policies to ensure personal information is safe.
“We now encrypt all of our hard drives on laptop devices, whether they belong to Medicentres or whether they belong to consultants that may be doing work for us. We’ve undertaken a full audit and continue to audit our systems to look at how we can physically safeguard information in addition to how we can use additional software to safeguard information,” said Bhimji.
Read the full Medicentres statement below.
The minister was also told that the theft of the laptop was reported to the Edmonton Police Service and Alberta’s Privacy Commissioner.
Police confirmed the laptop had been reported stolen to the EPS on Oct. 5. 2013. “An investigation is currently ongoing,” said a spokesperson.
Opposition parties are calling for change in the wake of the theft.
“Why is it that a single person at a private company can amass 620,000 pieces of information on individual patients, with all of this information in one place unencrypted, and then have it stolen?” asked Wildrose leader Danielle Smith. “It’s remarkable to me that this has occurred, that there isn’t a way for apparently the health minister to be notified when it occurs. As well, I have to question, what are the practices happening at other chain stores like this?”
“I think that there’s a serious question that we have here about who knew what when? Why wasn’t the minister told by the company? Why wasn’t the privacy commissioner telling the minister? Why didn’t the police tell the minister?”
“A breach of this magnitude is shocking,” said NDP Health Critic David Eggen. “For this government to fail in protecting such sensitive health information highlights the massive gaps we have in this province, and it is obvious that current legislation is not effective.”
The NDP is calling on the government to draft tougher legislation to ensure the private medical information of Albertan is better protected.
“What’s even more disturbing is the length of time it took for Albertans to find out about this breach. There needs to be far more accountability for all involved,” Eggen added.
Click here to view the full NDP response.
“Today, I contacted the Alberta’s Privacy Commissioner to speak about this incident and to formally request an official investigation under the Health Information Act with an aim to find out what happened, why health authorities have only just been informed, and what, if any, breaches of privacy legislation may have occurred,” said Horne on Wednesday.
“I have also contacted Alberta’s College of Physicians and Surgeons and the Alberta Medical Association regarding this incident so that they may take any steps that they deem necessary.
“I would encourage any Albertan who feels they may be affected and is concerned about this incident to contact Medicentres Family Health Care Clinics. I would also encourage those same Albertans to review information available from the Office of the Privacy Commissioner if they would like information on privacy legislation in general,” read Horne’s statement.
Comments