Hypervigilance is vital in wake of MCP breach, says privacy commissioner

Significant staff turnover at Medical Care Plan (MCP) is making it difficult to trace what exactly happened that a missing binder wasn’t reported as a privacy breach for nearly two years.
The binder was an informal log in which names, MCP numbers and communities of the applicants to the Adult Dentistry Program were kept.
“I was dismayed, quite honestly that this was happening … There is a legal obligation for people who have access to health information to deal with it in accordance with the law and the regulations and it wasn’t clear to me those policies were followed. Health and Community Services Minister John Haggie said Friday. 
“Certainly, the (Personal Health Information Act) has been in place for some time and when it was introduced there was initial training and there is an expectation the policies would be followed.”
The binder is still missing.
Haggie said because of the staffing turnaround it’s a challenge to backtrack and figure out how the blunder all started.
Late Tuesday afternoon, the department announced the Medical Care Plan (MCP) office in Grand Falls-Windsor was involved in the loss of a binder containing the personal health information of up to 3,300 individuals.
The department has put in place a number of safeguards since learning in October of the missing binder — which as discovered to have disappeared in January 2018. They include updating the claims tracking process. MCP now uses an electronic system with security features. Additional mandatory training is being provided to all staff that reiterates the importance of privacy protection, breach protocols, and information management best practices, the department had noted.
The binder was started in April 2015 and went missing by the end of 2017, Haggie noted.
It’s unknown exactly how many names were recorded in the binder, as the office administered the Adult Dentistry Program for the province, with as many as 3,300 people affected.
“It could be a small group. It could be everyone,” said Haggie, who was left apologizing for the gaffe.
The department also  asked MCP about the extent of how many such binders would exist across the MCP system and its various programs and it appears to be unique practice to the Grand Falls-Windsor office, Haggie said.
“Since we found out about it, we have made absolutely clear this is not the way this is to be done,” Haggie said Friday.
Newfoundland and Labrador Information and Privacy Commissioner Michael Harvey said he was notified Tuesday and the department is doing the right thing by fact-finding and notifying the affected people.
“I am gratified that they are following (the procedures) now that this has come to the minister's attention,” Harvey said.
His office would start an investigation if a complaint was made, but could also initiate a investigation if it sees merit. That decision hasn’t been made yet, as Harvey said the department is keeping his office in the loop.
Harvey noted that the custodians of information — in this case the staff at the MCP office — are required to notify people if there is a  risk to them. 
At this stage, he said he can’t tell if they MCP staff  had made that distinction, as the department is still looking into it
“It may have been MCP may have felt there was no risk to those people and so  didn’t notify them,” Harvey said.
“What we don’t know… is what was in the minds of those (MCP) people during the past two years while they were looking for that binder. Maybe they thought they didn’t need to (report it) I don’t know. It’s too early to say.”
When his office conducts any investigation and the resulting report would include any commentary on such a judgement call not to report something was a breach,  as well as any cautionary tale for public bodies.
In the meantime, Harvey urged the necessity of being on top of the responsibilities.
“Privacy in an era where there is so much information out there and our health information out there on different sites  requires heightened  vigilance on the part of all custodians,” he said.
“Particularly as we are in the transition from paper-based-systems to electronic-based systems, hypervigilance on the part of the custodians to protect the personal health information of Newfoundlanders and Labradorians is vital.”

[email protected]