Sarah Mills: Teachers deserve gratitude as school year wraps up
There's a collective sigh coming from Saskatchewan's teachers as the school year ends. Sarah Mills says teachers are ask...
A Facebook post about medical records strewn around a Regina alley started off a privacy investigation in Regina last fall.
According to a March 26 report from Saskatchewan’s privacy commissioner Ronald J. Kruzeniski, two people saw that post on a Facebook community page in late October 2024 and went to go gather as many records as they could, with one finding around 100 pages.
Read more:
- Sask. ignoring info requests from privacy commissioner: report
- Sask. privacy commissioner critical of LifeLabs, SHA over ransomware attack
- Ministry employee accused of being involved in immigration scheme
They took the pages and turned them in to Kruzeniski’s office. One also alerted the College of Physicians and Surgeons, which also spoke with the privacy commissioner’s office.
The records were from the Elphinstone Medical Clinic in Regina and two psychiatrists at the clinic — Dr. Chukwuemeka Odenigbo, who is listed as the clinic owner, and Dr. Nebeolisa Ezeasor.
The doctors explained to the commissioner that the documents had been in bins in the clinic that had been cleared marked as intended for shredding, but a cleaner who was covering for their regular cleaner tossed them into the bin in the alley.
Most of the medical documents were psychiatric intake forms that included people’s names, birth dates and the issues they were experiencing, as well as medical assessments and questionnaires. The records were for 88 people.
The doctors told the commissioner’s office that the situation was immediately brought up with the cleaning company when it happened and the employee in question was fired.
Those who were affected by the breach were notified by the medical clinic — some in person and some with a letter. In his report, the commissioner said the letter should have been more specific about what information was breached for each patient so people could mitigate their risks accordingly.
“While the level of detail of personal health information may vary for each affected individual, there are some details that could lead to an increased risk of identity theft because of the inclusion of home addresses, telephone numbers and SHNs (Saskatchewan Health Numbers). Given the highly sensitive nature of some of the personal health information involved, there is also a risk to reputation or character,” read the report.
Kruzeniski also recommended the affected people be offered credit monitoring for one year by the clinic.
The clinic had a confidentiality agreement with the cleaning company but the agreement didn’t mention employees, so Kruzeniski recommended an agreement be signed with each contractor and their employees, and to ensure they have privacy training.
The clinic had also changed some of its procedures since the breach. The report said it locks up shredding at the end of the day and there are now shredders in the office, but they still use open blue bins for documents that are waiting to be shredded.
The report recommended the clinic get lockable covers for the open bins to mitigate the risk of unintended consequences that come with open bins.
This isn’t the first time medical records have turned up in a bin in Regina. In 2011, thousands of patient files were discovered in a recycling dumpster outside a shopping mall. In that case, the records ending up in the trash were also blamed on cleaners.
