Montfort Hospital loses patient data

The personal information of those treated at the Montfort hospital in October 2012 is now unaccounted for after a USB key disappeared.
Montfort Hospital patient Laura Houston is among 25,000 people whose personal information is compromised after the hospital lost a USB key. (CBC)

The Montfort Hospital in Ottawa is informing patients treated at the facility last October their personal information could be compromised after an unsecured USB key went missing.

This week, Laura Houston received a letter from the hospital apologizing for the situation. While the hospital assured Houston that no banking information, her diagnosis or her address were among the missing data, her name, doctor and what service she received are all gone.

"That sort of triggered a little bit of panic in me," said Houston.

This is the second time in less than a week that CBC News has learned about a public agency losing sensitive personal information of clients. On Thursday, a St. John's lawyer filed a class action lawsuit on behalf of more than half-a-million people whose personal data was lost when Human Resources and Skills Development Canada could not account for a hard drive containing data belonging to former student loan recipients.

"I think there seems to be a little bit of a lack of responsibility with employees that get access to either USB sticks or portable drives," said Houston. "They have information that's pretty personal and private for the people and they should treat it with proper respect."

Houston is also disappointed that it took nearly three months to contact her about the situation.

"I just wonder what happened between then and now. How come it took them this long to realize it was missing? Maybe they knew ahead of time but they didn't let patients know about it," she said.

It is believed that up to 25,000 Montfort Hospital patients are affected.

The hospital's vice president Phillipe Marleau said that an employee who needed to take some work home downloaded the information onto a personal USB key.

"And between travel from the hospital and home, lost unfortunately the key," said Marleau.

While the employee's action was "non-authorized," according to Marleau, there was no malice or criminal intent, so the employee would not be punished or suspended. 

Moving forward, the hospital will ensure that any information that needs to be downloaded will be stored on secure, password encrypted USB keys.