The Middlesex-London Health Unit (MLHU) says it has wrapped up its investigation into a reported privacy breach involving whether personal information (PI) or personal health information (PHI) was disclosed when the health unit moved in March.
Electronic devices and paper documents that might’ve contained personal information were left behind at 50 King St., and the MLHU was notified on April 23 when employees of Middlesex County found them in a vault.
On Saturday, the MLHU provided the results of the investigation.
Eighty hard drives were left behind, two of which contained PI/PHI while two others contained user data, but no PI/PHI, according to the MLHU.
The PI and PHI contained on the drives included 35 referrals, information for 530 clients of the infant hearing and blind-low vision programs and the names and contact information of 150 MLHU volunteers.
The health unit says it’s “satisfied” that no one viewed the information, including County staff or anyone else.
The MLHU says there were also paper documents that contained the PHI of some clients.
This included client lists related to a food poisoning investigation, with information for 270 individuals associated with the investigation, a fax request for medical records and a fax immunization report for a school-aged child.
The health unit says Middlesex County administration has confirmed that none of the records were reviewed by County staff, and that the documents were held in a secure area until they were retrieved by Health Unit staff.
In terms of its next steps, the MLHU says it’s developing “… more comprehensive documentation for information technology standards and procedures,” which includes securely disposing old electronic devices and making sure the data they contain is erased.