Personal information on hard drives, documents left behind amid MLHU move, investigation reveals

The former Middlesex-London Health Unit building at King and Ridout streets in London, Ont., June 2017. Matthew Trevithick/980 CFPL

The Middlesex-London Health Unit (MLHU) says it has wrapped up its investigation into a reported privacy breach involving whether personal information (PI) or personal health information (PHI) was disclosed when the health unit moved in March.

Electronic devices and paper documents that might’ve contained personal information were left behind at 50 King St., and the MLHU was notified on April 23 when employees of Middlesex County found them in a vault.

On Saturday, the MLHU provided the results of the investigation.

Read more: Middlesex County contacts privacy commissioner claiming personal data left behind in MLHU move

Eighty hard drives were left behind, two of which contained PI/PHI while two others contained user data, but no PI/PHI, according to the MLHU.

Story continues below advertisement

The PI and PHI contained on the drives included 35 referrals, information for 530 clients of the infant hearing and blind-low vision programs and the names and contact information of 150 MLHU volunteers.

The health unit says it’s “satisfied” that no one viewed the information, including County staff or anyone else.

Read more: Medical officer of health defends MLHU’s move after county council highlights ‘appalling’ photos

The MLHU says there were also paper documents that contained the PHI of some clients.

This included client lists related to a food poisoning investigation, with information for 270 individuals associated with the investigation, a fax request for medical records and a fax immunization report for a school-aged child.

The health unit says Middlesex County administration has confirmed that none of the records were reviewed by County staff, and that the documents were held in a secure area until they were retrieved by Health Unit staff.

In terms of its next steps, the MLHU says it’s developing “… more comprehensive documentation for information technology standards and procedures,” which includes securely disposing old electronic devices and making sure the data they contain is erased.

Click to play video 'Major privacy breach at BC Cancer Foundation' Major privacy breach at BC Cancer Foundation
Major privacy breach at BC Cancer Foundation – Jul 30, 2020