Ontario's privacy commissioner is investigating after records containing the personal health information of nearly 6,500 Ontarians who took part in the province's colon cancer screening program may have gone missing.
Cancer Care Ontario says Canada Post cannot confirm the delivery of 15 screening activity reports that contain information on thousands of people, including names, birthdates, gender, health card numbers and cancer screening test data.
The reports were sent to doctors in February and March and contain information from Ontarians aged 50 to 75 in the ColonCancerCheck program, a provincial initiative to educate people about and screen them for colorectal cancer.
Cancer Care Ontario contracted Canada Post to courier the reports via its Xpresspost service. They were to be tracked online, with signatures obtained upon delivery to the physicians' offices.
To date, Canada Post has not been able to provide an explanation for the unconfirmed deliveries.
"We have not been able to confirm the delivery of 15 reports, and that is 6,490 records," said Pamela Spencer, Cancer Care Ontario's vice-president of corporate services and chief privacy officer. "We are also investigating an additional 11 reports, and that has a possible addition of 5,440 records."
Canada Post was supposed to send the packages back to the agency if it couldn't get a signature upon delivery, but it admits that some reports were delivered without signature confirmation.
'Medical test results rank among the most sensitive personal information about an individual.' —Privacy commissioner Ann Cavoukian
"We take this matter very seriously and have conducted a thorough investigation to find out how many screening activity reports cannot be confirmed as delivered," said Linda Rabeneck, a vice-president at Cancer Care Ontario. "Due to the personal health information contained in the reports, we are informing the relevant primary care physicians and patients, and the public."
The office of Ontario's privacy commissioner said it's checking whether there was a privacy breach for the nearly 12,000 patients included in the reports.
"Medical test results rank among the most sensitive personal information about an individual," information commissioner Ann Cavoukian said in a statement Tuesday.
The investigation's goal is to ensure a similar incident doesn't happen again.
The reports did not contain results unknown to patients but rather were summaries to be kept on record.