What happened? Regretfully, an SD card (portable computer memory card) that contained personal health information about clients participating in our Healthy Babies Healthy Children program went missing and is believed to have been stolen when a bag was taken from the vehicle of an employee. Information contained on the SD card is related to clients in the program from March 2010 to August 2011, along with 46 additional clients from earlier dates.
What information has gone missing? Information about clients participating in the Healthy Babies Healthy Children program including name, address, birth date/age, marital status and assessment information for the Healthy Babies Healthy Children program. It does not include Social Insurance or Health Card numbers because this information was never collected.
How many people are affected? Information about over 18,000 clients was included on the SD card.
How could this happen? We sincerely apologize for this breach. We are investigating this incident and closely reviewing our privacy practices to make sure such an incident never happens again. We take protecting your personal information very seriously.
What is being done to notify those affected? Those affected will be notified by letter and/or telephone. The media has also been informed through a media statement. Information about the incident will be posted on www.peelregion.ca.
What can those affected do to protect their identities? While there was no financial information included in the missing information, you may want to monitor and verify all bank accounts, credit cards and other financial statements for any suspicious activity. Contact your financial institution directly if you suspect any misuse of your personal information.
If you are concerned that you may become a victim of fraud, you may request that a credit reporting bureau place a fraud alert on your credit files instructing creditors to contact you before opening any new accounts. Credit reporting bureaus include Equifax - www.equifax.com and TransUnion - http://www.transunion.ca.
Was the SD card lost or stolen? Police have not been able to locate the missing bag and SD card, and are considering them stolen.
Was the SD card encrypted? No. The information is not protected and could be accessed on most computers.
Why was this information taken offsite? This was an isolated incident. We are working to determine why the information was taken offsite.
Is it standard practice to use non-encrypted devices to transport personal health information? No. It is not standard or acceptable practice for client information to be taken offsite using a non-encrypted device. We have instructed employees that all electronic storage devices that contain personal health information must be encrypted.
When was the SD card reported missing? The employee reported the SD card was missing on Tuesday, September 24 after realizing it was missing on the evening of Monday, September 23. The employee believes the SD card may have gone missing as early as Friday, September 20.
Why was there a delay in notifying the public? Internal investigations, along with a thorough search with the assistance of police, had to be done to determine if the SD card was truly missing and if it contained files with personal health information.
Have you completed the investigation? No. The investigation is ongoing, but we made notifying clients our top priority once we confirmed that client information was on the SD card.
Does Peel Public Health have privacy policies? Yes. We work to comply with the Municipal Freedom of Information and Protection of Privacy Act and the Personal Health Information Protection Act. We will be examining all of our privacy policies, protocols and practices, and tightening controls on the information that has been entrusted to us.
What actions has Peel Public Health taken so far in response to this incident? We have notified all clients whose information may have been on the SD card. We have also reinforced our privacy practices with staff.
The incident has been reported to the province's Office of the Information and Privacy Commissioner. The Ministry of Children and Youth Services, who oversees the Healthy Babies Healthy Children program, has also been notified. The police have been contacted to assist with the search for the SD card. We have reviewed our practices to prevent this from happening again.
Who was the employee transporting the data? The individual was a Health Services employee.
How do those affected find out what personal information of theirs was on the SD card? They should contact 905-791-5202 or 1-866-888-9007 for more information about what specific information of theirs was on the SD card.
What information does Peel Public Health have about individuals in the program? We collect information only as required to provide programs and services. That information is associated only with the service provided. It is collected and stored in compliance with the Municipal Freedom of Information and Protection of Privacy Act and the Personal Health Information Protection Act.
Can an individual find out what personal information you have about them? You can contact 905-799-7700 to make a chart request for your Healthy Babies Healthy Children information.
Has the Office of the Information and Privacy Commissioner of Ontario been notified about this issue? Yes. We have notified the Office of the Information and Privacy Commissioner of Ontario. We are working cooperatively with them to ensure all recommended actions are undertaken.
Healthy Babies Healthy Children is a program of the Ontario government. Has the provincial government been notified? Yes. We have notified the Ministry of Children and Youth Services about the incident and are keeping them informed about the situation.
Are the police involved? Yes. The police are assisting with the search for the SD card.
I would like to send a letter – who can I address it to?
David L. Mowat, Medical Officer of Health
Peel Public Health, Office of the Medical Officer of Health
7120 Hurontario St., PO Box 667 RPO Streetsville
Mississauga, ON, L5M 2C2
Robynne Malhotra, Privacy Specialist
7120 Hurontario St., PO Box 664 RPO Streetsville
Mississauga, ON, L5M 2C2
If you have concerns with the Region of Peel's privacy practices, you may file a written complaint with the Office of the Information and Privacy Commissioner. Information about the complaint process can be obtained by visiting http://www.ipc.on.ca.