A Toronto man is raising concerns about the privacy of patients after he discovered what he believes are the names, birth dates and health card numbers of 60 people on the back of a prescription printed for his wife by her family doctor.
Last month, Eddie Soltani's wife had an appointment with Dr. Michael Lai in downtown Toronto.
Her husband picked her up and they were about to fill the prescription when Soltani says he discovered a list on the other side containing what he believes is personal information of Lai's patients.
"I was actually kind of nervous," he told CBC Toronto. "I'm holding information I'm not authorized to hold. And my wife is a patient here. What about her information? Is that safe?"
Soltani said he didn't feel comfortable directly approaching the doctor because he didn't think "the burden should be on a patient" to ask why a physician didn't handle the information properly.
Alerting public sector institutions
He says he brought the sheet of paper to a Service Ontario location, but says he didn't get anywhere.
"I was expecting a rapid response kind of thing. Call someone, make a trip to the doctor's office. Don't [they] have a program in place to deal with situations like this?" he asked.
Instead, he said he was told to call the OHIP fraud hotline. He says he did so, only to be told the issue did not constitute fraud.
"I protect my personal information all the time. Yes, I'm protecting that piece of plastic, but who is actually protecting the information behind the scenes?" - Eddie Soltani
The operator redirected him to the Ontario privacy commissioner's office, which he said he called, but was told they couldn't help him either unless he made a formal complaint. Soltani thought informing them was enough.
"It boggles my mind," he said. "I protect my personal information all the time. Yes, I'm protecting that piece of plastic, but who is actually protecting the information behind the scenes? I think it's critical to give the people a way to say, 'I've done my part. I've reported.'"
The Office of the Information and Privacy Commissioner of Ontario told CBC Toronto it found no record of Soltani contacting its office, though in a case like this, according to spokesperson Tiffanie Ing, the office would "contact the doctor to find out how this mistake was made ... and ensure that the doctor notified the patient whose information went astray."
Ing said the commissioner's office "absolutely responds to tips and does not require a formal complaint in order to act." She also confirmed the office has launched an investigation after CBC Toronto first published the story.
'Action should be taken'
Former privacy commissioner Ann Cavoukian said some "action should be taken" to inform the patients if there was a breach of privacy.
"Personal health information is the most sensitive information that exists," she said. "That information belongs to no one other than yourself and your physician who is treating you. So, if it was made accessible to someone else, it's completely inappropriate."
Cavoukian said health information can reveal a lot about a person and can affect someone's career advancement and other aspects of their lives.
"Part of taking care of patients is protecting their health information in the strongest possible way," she said.
'It must be a mistake'
CBC Toronto spoke with Lai, the family doctor, who did not deny Soltani's allegations, but refused a request for an interview.
"It must be a mistake. Sorry about that. No comment," he said.
The College of Physicians and Surgeons of Ontario confirmed it has no record of complaints or disciplinary history concerning Lai.
The college refused to comment specifically about the alleged breach of privacy.