Ontario Information and Privacy Commissioner Ann Cavoukian says the issue of data security at health-care facilities has to be 'driven home dramatically.' (Canadian Press)

The head of Ontario's privacy watchdog says she "hit the roof" after hearing from CBC News that a computer memory stick containing the medical files of hundreds of Toronto patients was stolen.

Last week, the University Health Network (UHN) sent letters to 763 patients who had undergone surgery at one of three of its sites between January and March of this year — Toronto General, Toronto Western and Princess Margaret hospitals — informing them that their medical information had been compromised, the CBC's Metro Morning has learned.

Some of their files were copied onto an unencrypted USB key, which was stolen from the purse of a staff member on June 18, the letter said.

While the patients' OHIP numbers, addresses and other contact information weren't in the files, the patients' names, their admission and discharge dates and any surgical procedures they underwent were. Police have been informed, but the memory stick has not been recovered.

Ontario's Information and Privacy Commissioner Ann Cavoukian learned about the breach from CBC News — not the health network.

"I hit the roof. I was very distressed," said Cavoukian.

"I was hoping we wouldn't have a repeat of this situation again."

Her comments come seven months after she urged every health authority in the province to ensure health records are encrypted. Her entreaty was prompted by another security breach at a Toronto-area health agency.

An unencrypted memory stick containing data collected from more than 83,000 patients in the Durham Region just east of Toronto during H1N1 flu vaccination clinics between Oct. 23 and Dec. 15 had been misplaced.

"Obviously, the message isn't getting out as clearly as it needs to be," Cavoukian said.

Not informing privacy commissioner a 'mistake'

Dr. Bob Bell, president and CEO of the UHN, acknowledged it was a "mistake on our behalf" that Cavoukian was not informed.

"There was a decision made that this wasn't a significant enough breach to warrant informing the commissioner, and I've apologized to the commissioner for that," he said.

He added that it is the UHN's policy that medical information on any mobile device needs to be encrypted.

"The employee had not realized that there was personal health information on that USB key," said Bell.

The network is looking to make some changes to prevent future breaches, including the automatic encryption of any device that gets used by the network, he said.

Meanwhile, Cavoukian said she is calling for all health regulatory colleges, medical colleges and associations to educate their members and other health professionals about data security.

"The ease with which we transfer information now and we engage in online activities, somehow it's factoring into this and not making people go through the steps they need to," said Cavoukian.

"I think we have to put this top of mind. It has to be on their radar and it has to be driven home dramatically."