Ont. privacy commissioner orders 'strong encryption' of health records
Last Updated: Thursday, January 14, 2010 | 8:58 AM ET
CBC News
A USB key similar to this one was misplaced by a nurse in Durham Region. The memory stick contained the health records of more than 80,000 people. (CBC)Ontario's privacy commissioner has ordered the Durham Health Region to make sure computerized health records are "strongly encrypted" to avoid another embarrassing loss of health information.
In December the Durham health authority, which is responsible for a large area east of Toronto, announced it had lost the medical records of thousands people after a nurse misplaced a USB key at Durham region's headquarters in Whitby, Ont.
The information on the USB key, also known as a memory stick, was not encrypted.
The device contained data collected from more than 83,000 patients during H1N1 flu vaccination clinics in the region between Oct. 23 and Dec. 15.
On Thursday, Ontario privacy commissioner Ann Cavoukian said Durham must ensure the safety of patient records and ordered it "to immediately implement procedures to ensure that any personal health information stored on any mobile devices [laptops, memory sticks, etc] is strongly encrypted."
Cavoukian made clear in her report that she expects every health authority in the province — not just Durham — to follow suit.
"While I accept that custodians may not be able to totally eliminate the loss or theft of mobile devices, what I cannot accept is that the information contained therein is not encrypted," the commissioner said in a prepared statement.
"Unauthorized access to health information stored on these devices that happen to be lost or stolen may clearly be prevented through the use of encryption technology. However, despite strong incentives to avoid privacy breaches and the availability of encryption to prevent such breaches, unencrypted mobile devices continued to be used. This is both distressing and completely unacceptable."
The commissioner has asked that the Ministry of Health make periodic checks to ensure that health information is being handled correctly.
Durham Region says it has already taken steps to comply with the order.
