On May 9 a GNWT laptop that contained the personal health information of over 30, 000 Northwest Territories residents was stolen from a locked vehicle in Ottawa.
“The hard drive on that device had personal health information, including individual health card numbers, dates of birth, names, conditions, immunization information and lab test results,” says Bruce Cooper, deputy minister of health and social services.
The information on the laptop was used for statistical analysis and contained over 45,000 references of personal information of residents of the Northwest Territories.
“Of that number, I can confirm 33,661 unique NWT residents may have been affected by this incident,” says Cooper.
“Although the device had strong password protection, the device was not encrypted,” according to a press release from the department.
The Ottawa Police were informed on the same date the theft occurred.
The department’s Chief Privacy Officer concluded her initial investigation on June 18 and determined that a privacy breach did occur because the data was unencrypted. The department says they currently have no evidence that the data was accessed by an outside party.
The stolen laptop had a SIM card which allows it to connect to cellular networks and has since been deactivated.
“If the device had connected to cell following the theft, we would have been able to trace and find it. And we were advised by our cellular provider that no activity has been reported on the SIM card,” says Cooper.
Cooper says the department takes the protection of privacy very seriously.
“We understand the importance of protecting personal health information as part of the culture of healthcare,” says Cooper.
“In an event like this, it’s important that we are as transparent as possible and we hold ourselves to a high standard in the protection of personal health information. And in this instance, clearly we failed to meet that standard, and I want to apologize to residents who may be impacted by this breach,” Cooper says.
Cooper says the department was under the impression that the device was encrypted, and says that if it had been, there would have been no security breach.
The Northwest Territories Information and Privacy Commissioner was informed of the breach on June 26, when the investigation was complete.
The Department of Health and Social Services says it has taken steps in response to the theft and to prevent any future breaches, including working with the Department of Infrastructure to ensure all Health and Social Services laptops and electronic devices are encrypted.
The department also says it will provide additional training sessions for staff, require new employees to receive privacy training and make sure that departmental policies are clear that encryption is required on all portable devices.
