Middlesex County is seeking guidance from the province’s privacy commissioner after it says it discovered personal information on computers left behind by the Middlesex-London Health Unit (MLHU) in its move from 50 King Street last week.
A letter to the Information and Privacy Commissioner of Ontario dated April 23 from Middlesex County’s privacy officer and county clerk, Kathleen Bunting, states that items left behind by the MLHU in its move have been found to contain personal information that is “not appropriate” for the county to have in its possession.
“County IT staff were reviewing some of the computer equipment from the perspective of repurposing it for corporate and public use, when it was found that many of the hard drives contained Health Unit related personal information and potential personal health information of individuals,” she wrote.
“Once it was determined that a Health Unit data breach had occurred, IT Staff halted any additional review.”
In an interview on April 15, before the letter was made public, medical officer of health Dr. Chris Mackie was asked specifically on The Craig Needles Show on Global News Radio 980 CFPL whether electronics left behind had been wiped.
“I think you probably know the answer to that question, Craig: it’s a basic part of health work that you protect personal health information and all personal information that might be sensitive,” Mackie had said.
“All of that equipment was definitely wiped.”
In an interview with Needles on Fri., April 24, Mackie said it was evident there was a breakdown in communication somewhere along the line.
“I understand the concern and certainly we regret and apologize to the public for leaving that equipment behind.”
Mackie said the equipment was in a vault that was closed when movers went through.
“They missed it. That was very unfortunate and completely understandable in the context of a pandemic where all of our staff are redeployed towards saving lives and even movers — we had a limited number of days to deal with movers before they were deemed non-essential services and shut down as well.”
As of April 24, moving services were still listed as essential services by the provincial government.
Previously, Thames Centre deputy mayor and Middlesex County council member Kelly Elliott told Global News that if the MLHU had asked for additional time, considering “the climate that we’re in,” they “could’ve worked something out.”
Mackie also claimed on Friday that the health unit reached out to the county “as soon as we learned that there were laptops left behind last week.”
“The privacy commissioner will, if anything, direct the county to return the equipment which is what we’ve been asking for for about a week now.”
In an effort to calm any public concerns, Mackie also noted that, at this point, there has been “no release publicly of any personal health information or personal information at all.”
He also noted that it was not clear to him whether or not there was personal health information, specifically, left on the equipment.
“We will be investigating that and taking appropriate action if there was,” he said.
“My staff told me that we used DBAN military-grade erasing techniques and that that was done with all the equipment. Until I see it, I can’t comment on exactly what was there.”
The letter did not state what kind of information was found, though it did allege that as soon as personal information was discovered, staff ceased reviewing the equipment. According to the letter, the county believes it is now not only in possession of personal information which is “not appropriate for it to collect” under section 28 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), but it’s potentially in possession of personal health information which would fall under the Personal Health Information Protection Act (PHIPA).
“The County is not a health information custodian under PHIPA.”
The county, through the letter, is asking the province’s privacy commissioner to provide guidance in how to properly deal with the personal information the county says it has found itself in possession of.
The county makes two suggestions, asking first that it be able to provide the MLHU access to the equipment so they can remove the information properly and safely under PHIPA standards. Secondly, the county asks that letters required under PHIPA to be sent by the health unit to individuals impacted by the alleged data breach “also satisfy the County’s requirement to provide notice of its receipt of personal information to impacted individuals under MFIPPA” without the county having to send separate letters.
Before the alleged confidential data was discovered, county council had already raised concerns over the “appalling” amount of items left behind by the health unit as it moved from 50 King Street to Citi Plaza at 355 Wellington Street.
At that time, Thames Centre deputy mayor Kelly Elliott said the health unit had left behind innumerable items, including: board room tables, easels, projectors, smart boards, filing cabinets, desks, office chairs, laptops, hard drives, computer monitors, wireless microphones, printers, baby scales, kids’ programming activities, and “heaps and heaps and hallways of garbage.”
Dr. Chris Mackie defended the decisions the health unit made, arguing that deliberate choices were made in terms of what to leave behind.
“Could we have squeezed some more things in? Yes. It would have come at a cost of our staff time — which is a taxpayer cost — and of efficiency over the long run, which is a major taxpayer cost over the 30-year life expectancy of this lease.”
Mackie said that he understands that photos showing what was left behind “could get people concerned,” but he says trying to move what was left behind would have increased moving costs and increased costs in the long run due to using “inefficient furniture, equipment, technology.”
“It’s a project we’ve been working on, blood, sweat, and tears for five years. We were very proud to bring it in well under budget and right on time,” he said.
“Many people put a lot of their lives into making sure that decisions were made right. The process that we had was world class.”
Mackie also noted that the health unit is now saving $200,000 a year in taxpayer money in lease costs, as it down-sized from an 85,000 square foot to a 68,000 square foot facility.