PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. PC-020014-1

 

 

Ministry of Health and Long-Term Care

 

 

 

 

 

 

September 5, 2002

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   PC-020014-1

 

 

 

MEDIATOR:                                                            Mumtaz Jiwan

 

 

 

INSTITUTION:                                            Ministry of Health and Long-Term Care

 

 

 

SUMMARY OF COMMISSIONER INITIATED COMPLAINT:

 

On March 20, 2002, the Ministry of Health and Long-Term Care (the Ministry) notified the Office of the Information and Privacy Commissioner  (the IPC) about a possible breach of the Freedom of Information and Protection of Privacy Act (the Act).  The Ministry advised that records, possibly containing personal information of staff and patients, were discovered by Ontario Public Service Employees Union (OPSEU) members, who were also employees of the Whitby Mental Health Centre, at a property previously occupied by the Whitby Mental Health Centre (the old WMHC site). 

 

On the same day, the IPC received a copy of a press release from OPSEU also stating that its representatives had found these records on the old WMHC site.  OPSEU had rented part of this property to use as an office during the labour strike which began on March 13, 2002.  The IPC immediately contacted OPSEU and, according to OPSEU, there was reason to believe that additional Ministry records containing personal information still remain in the building and other buildings located on the old WMHC site.

 

On March 21, 2002, the IPC received a number of calls from individuals who expressed their concern that records containing their personal information might be among the records found on the old WMHC site.

 

On this basis, the IPC initiated an investigation pursuant to our responsibilities under the Act.  The investigation focussed on the disclosure and the secure disposal of personal information in two areas: (1) the boxes of information found and retrieved from the old WMHC site and (2) whether additional records containing personal information remain unsecured in the same building and /or the other buildings located on the old WMHC site.

 

 

This office continued to receive numerous calls, e-mails and facsimile from concerned citizens, including both staff and former staff and former patients of the WMHC.  All the callers expressed growing concern about the security of their information that might be among the records retrieved, as well as any records which might still remain on the old WMHC site.

 

DISCUSSION:

 

1) The found boxes

 

As part of my investigation I interviewed the four individuals who had knowledge of the records found and subsequently put into the boxes: two individuals (Witness A and Witness B) who discovered the records; one individual (Witness C) who saw some of the records in the boxes; and the hospital administrator to whom the boxes were delivered.

 

Evidence of Witness A:

 

Witness A stated that she was in Building # 30 during the OPSEU strike.  Witness A explained that part of the building had been rented by OPSEU for the duration of the strike.  Witness A stated that she, together with Witness B and others went into the building to try and keep warm.  They walked through a number of empty rooms and found them littered with paper.  Witness A said that paper was scattered on the floors in the rooms and in the hallways.  It appeared as if the place had been vandalized and the paper deliberately thrown about. 

 

Witness A said that the papers looked familiar and, upon examination, she discovered that they were Ministry documents.  Witness A said that she, Witness B and the others picked up what they could and put them into some boxes.  They carried the boxes out of the building.  They met Witness C whose car was parked outside the building.  Witness A stated that they put the boxes into Witness C’s car for safekeeping. 

 

Witness A stated that the documents that she saw and which she put into the boxes included attendance records for patients, group notes and purchase orders.  Witness A stated that she did not remove any records from the boxes nor did she make any photocopies.  Witness A stated that many more records remain in the building.  Witness A stated that attempts made to deliver the boxes to the administrator were not successful and the records were then turned over to Durham Regional Police. 

 

A few days later Witness A received additional Ministry documents that were found by OPSEU members in the building.  Witness A stated that she put these documents, which included attendance records for group patients and notes, into an inter-office envelope and delivered them to the Patient Advocate who, in turn, delivered them to the administrator.  Witness A said that she then posted a notice in Building # 30, requesting members not to remove any documents from the building and also to not enter any part of the property that was not leased by OPSEU.

 

Witness A has provided me with a written consent indicating that she is willing to speak with the Ministry staff and/or the police with a view to assist in any further investigation. 

 

Evidence of Witness B:

 

Witness B stated that she had gone to Building # 30 to pick up her strike pay.  She was with a group of people, including Witness A, as they walked through the building.  Witness B stated that they went to see an old office on the 5^th floor and saw an empty office with lots of paper scattered all over the floor.  Witness B stated that she looked at some of the papers and realized that they were Ministry documents.  Witness B stated that the documents included attendance records, bereavement leave forms, books of patients’ PIN money with withdrawal slips, administrative records with staff and patient information.  Witness B explained that patients have accounts for their money and the withdrawal slips are used for them to withdraw the funds.  The withdrawal slips contain the names of the patients and the signatures of the staff.  Witness B indicated that she recognized the name of a current patient in one of the books. Witness B stated that she, together with Witness A and the others, put as many of the documents as they could into some boxes and carried them out of the building.  They placed the boxes into Witness C’s car. Witness B stated that she did not remove any records from the boxes nor did she make any photocopies.  Witness B stated that many more records remain in the building.

 

Witness B has provided me with a written consent indicating she is willing to speak with the Ministry staff and/or the police with a view to assist in any further investigation.

 

Evidence of Witness C:

 

Witness C stated that she was at the building during the labour strike when Witnesses A and B brought her the boxes of documents, which were placed in her car.  Witness C stated that she looked through the boxes and found staff payroll stubs, patient discharge forms and Occupational Therapy referral forms.  Witness C stated that neither she nor anyone who had seen the records, including Witness A and B, removed any records or made any photocopies.  Witness C stated that she did make a list of the various types of records in the boxes.  A copy of her list was provided to this office.  Witness C stated that she attempted to deliver the boxes to the administrator but was not successful.  Witness C stated that she then delivered the boxes to the Durham Regional Police.

 

Witness C has provided me with a written consent indicating she is willing to speak with the Ministry and/or the police with a view to assisting in any further investigation. 

 

Evidence of the Administrator:

 

The Administrator said that he received a call on the morning of March 20, 2002 from the president of the OPSEU local inviting him to come to the picket line at 11.30 a.m. for a meeting.  He called her back to find out the purpose of the meeting; she told him that she had something to give him but did not specify what it was.  He told her he could not meet her at the requested time.  Shortly thereafter, he received another telephone call from the president of the OPSEU local asking him again to meet her at 11.30 at the picket line.  Due to the critical situation at the WMHC, he could not meet with her.  Later that same day, he became aware of an OPSEU media release and news reports regarding records which OPSEU members had found on the old WMHC site. 

That same evening, he received two boxes of records from the Durham Regional Police.  The administrator stated that he briefly looked through the boxes and found routine hospital memoranda, receipts of sundry expenditures, minutes of meetings and other records relating mostly to the Occupational Therapy department.  The administrator explained that the Occupational Therapy department was previously housed in Building # 30.  Upon a second review, he noted that the records included staff attendance records and patient records.  The dates of the records in the boxes ranged from 1970’s to early 1990’s.  The administrator stated that approximately two days later, he did receive more records in an inter-office envelope from the Patient Advocate who had received it from Witness A. 

 

The administrator advised that the records are stored in his office.  He stated that the records containing personal information would be reviewed and either shredded or stored in accordance with the requirements of the records retention schedule.  The administrator confirmed that records containing patient and/or clinical information are required to be held for five years, after which they would be put on microfiche and stored for 45 years.  The originals would then be shredded.  With respect to employee records, the administrator stated that these would be reviewed and dealt with in accordance with the requirements of the Ministry’s records retention schedule.

 

The administrator explained that the WMHC moved from the old site to its current site in September 1996.  The old site contains some 40 buildings, some of which are condemned and/or boarded up.  The administrator stated that considerable planning was involved in the move which was completed over a two-week period.  He explained that the new site is half the size of the old site and the intention was to reduce, through appropriate purging and shredding, all unnecessary paper documentation.  Part of the plan included a proposal to make routine administrative forms available electronically.  As a result and in anticipation of the move, a comprehensive plan “Project Clean Sweep” was put in place to ensure that all documentation was dealt with responsibly.  Part of the purpose was also to educate the staff on records management, to identify documents and learn how to treat the materials appropriately.  Project Clean Sweep was initiated in 1995 and documents were purged and shredded in accordance with the records retention schedule and stored electronically or in paper form, where necessary.  The manager of each department was responsible for the purging, shredding or storage of the documentation. 

 

The administrator stated that after the completion of the move, staff went back to the old WMHC site on two separate occasions to ensure that all documents had been removed.  The administrator stated that on both occasions staff found documents that had been left behind.  Upon further questioning the administrator stated that some of these documents did contain personal information.  He stated that after the second check by his staff, he was satisfied then that no sensitive documents remained on the old WMHC site.

 

The administrator stressed that a great deal of care was exercised to ensure the security of the documents and that all procedures of the protocol were followed.  This required that records are packed in boxes in sequential order, numbered and a contents list prepared for each box.  The administrator acknowledged that a final sign-off/check-off system was not used to ensure that every office had been checked for documents.  He stated that he relied on the knowledge and expertise of the staff to ensure that all documents had been appropriately dealt with.  He noted that clinical and confidential records had been packed in boxes and secured in containers away from the staff and movers during the actual move.  Staff at both sites attended to the removal and delivery of these records.  The administrator said that the WMHC had a lot of educational materials in the form of brochures and binders and that it is these types of documents that may have been left behind.

 

The Ministry arranged for me to view the records in the boxes found and returned by Durham Regional Police Service.  The Ministry also provided me with copies of the Action Plan for Project Clean Sweep and the various records retention schedules.

 

The following issues were identified as arising from Part 1 of the investigation into the found records:

 

(A)  Is the information “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act defines “personal information” as “…recorded information about an identifiable individual, including,

 

(a)    information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

 

(b)  information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,…

 

(h)   the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

I have reviewed all of the records in the boxes and in the inter-office envelope, provided to me by the Ministry. 

 

The records that I reviewed covered the period from 1977 to the early 1990’s.  The records included: 

 

statement of travelling expenses,

staff attendance records,

calendar with staff assignment,

correspondence regarding placement of students,

training materials, educational and training agreements, annual reports,

internal memoranda,

staff calendar of assignments, letters re placement of students, draft agreements regarding use of clinical facilities by students, correspondence,

position specifications and wage negotiation, handwritten notes, recruitment/retention questionnaire,

management training materials,

blank forms, expense sheets, expense records and advances, requests for vacation accumulation for named staff,

employment brochures from Immigration Canada,

canteen accounts and receipts and purchase orders, receipts with signatures,

equipment budget proposal,

program evaluations,

staff discipline policy,

folders of cash sales, and folders of program expense records,

overtime sheets for staff (requests and approvals),

Occupational Therapy staff self- audits with list of patients, forms requesting approval for courses for named staff and department statistics, 

activity records for Occupational Therapy services,

agendas for meetings, minutes of meetings

Rehabilitation Committee, Quality Assurance Committee and Occupational Therapy department documents,

book of Patient Community Fund, withdrawal books for patients’ funds,

clinical records deficiencies lists,

running ledger books and receipt books for purchases.

 

Based on my review of the records, it appeared that most of the records originated with the Occupational Therapy department.  Not all, but certainly many of the records contain the personal information of both patients and staff, as set out in section 2(1) of the Act. 

 

The records relating to staff include the names of staff with their records of attendance, courses taken, areas or departments in which they worked, the vacation days accumulated and overtime hours worked together with performance appraisals (self-audits).  I find that these records clearly contain information which qualifies as personal information under section 2(1)(b) (education or employment history) and section 2(1)(h) (individual’s name where it appears with other personal information relating to the individual). 

 

Records relating to patients include their names, types of therapeutic services received while being a patient at a mental institution, dates and times of the treatments, dates and amounts of withdrawals of money from their accounts and what it was spent on.  I find that these records clearly contain information which qualifies as personal information under section 2(1)(b) (medical, psychiatric, psychological history or information relating to financial transactions) and section 2(1)(h) (individual’s name where it appears with other personal information relating to the individual).

 

(B) Was the disclosure of the “personal information” in accordance with section 42 of the Act?

 

The first two priorities when faced with a potential disclosure of personal information are: (1) to identify the scope of the actual disclosure and take steps to contain it; and (2) to identify those individuals whose personal information has been disclosed and, barring exceptional circumstances, to notify those individuals accordingly.  

 

Section 42 of the Act sets out a number of circumstances under which an institution may disclose personal information.  None of these circumstances are present in this case, a case in which OPSEU members found the personal information lying unsecured in a former WMHC building.  Accordingly, I find that the disclosure of the personal information by the Ministry was not in compliance with the Act. 

 

(C) Was the personal information disposed of in a secure manner as required by section 40(4) of the Act and Regulation 459?

 

Section 40(4) of the Act deals with the disposal of personal information.  It states:

 

A head shall dispose of personal information under the control of the institution in accordance with the regulations.

 

Ontario Regulation 459, implemented under the Act pertains to the disposal of personal information.  Sections 4(1) and 5 of the regulation provide as follows:

 

4(1) Every head shall ensure that all reasonable steps are taken to protect the security and confidentiality of personal information that is to be destroyed, including protecting its security and confidentiality during its storage, transportation, handling and destruction. 

 

The found records range in date from 1977 to 1990. 

 

Based on my review of the Ministry’s retention schedule for patient records, hard copy records are required to be held for five years after which they are required to be retained on microfiche for 45 years.  Based on their schedules and the requirements under the Act, many of these records should have been microfilmed and/or destroyed.

 

The Ministry’s retention schedule for personnel files and employment records requires that original copies are retained for the current plus one year in the office and held for an additional nine years at an off-site records centre after which it is destroyed.  Duplicate copies are required to be held for the current year plus one year after which they are required to be destroyed.  These requirements were clearly not followed. 

 

I find therefore, that the personal information in both the staff and patient records was not disposed of in a secure manner as required by section 40(4) of the Act and Regulation 459.

 

While neither the disclosure nor the disposal of the personal information was in accordance with the Act, what makes this situation even more problematic is that it involved records relating to staff and patients at a mental health institution.  The problem is further exacerbated by allegations that more records remain on the old WMHC site. 

 

The procedures and protocol established by an institution when moving from one location to another require a high degree of care and attention to detail to ensure that adequate safeguards are in place to protect the privacy of personal information in its custody.  When such a move is undertaken at a mental health centre, the highest degree of care and caution should be exercised to avoid human error and incidents such as this through inadvertence. 

 

2) Additional unsecured personal information

 

On March 22, 2002, two days after this office was given notice of the potential privacy breach, Assistant Commissioner Tom Mitchinson wrote to the Acting Deputy Minister regarding the seriousness of the situation.  He noted that according to OPSEU, records found on the site were turned over to the Durham Regional Police who eventually turned them over to the Whitby Mental Health Centre.  Just as, if not more disturbing, were the concerns that additional records remained unsecured at Building # 30 and the other buildings on the former site.  In the letter, the Assistant Commissioner stated:

 

I understand and accept that you and others at the Ministry are putting considerable effort into dealing with this issue.  However, I am concerned that it has now been two days since the Ministry was made aware that sensitive personal information belonging to the Ministry may be located on these premises, and has not yet been able to provide this office with assurances that this information has been identified and properly secured.  Until the necessary steps have been taken, there is a significant risk that other disclosure of sensitive personal [information] may occur.

 

It is critically important that the Ministry deal with these containment issues as a priority, and that you be in a position to assure both yourself and this office that all information belonging to the Ministry that is housed in former premises on the Whitby Mental Health Centre site is properly secured.

 

The Ministry responded, acknowledging the gravity of the situation and advising that attempts to contact the current owner of the old WMHC site (the landlord) for permission to enter the buildings in order to secure any documents that might still be there had not been successful to date.  The Ministry stated that it was its highest priority to continue to investigate and legally resolve the issue, but pointed out that it was unable to enter the buildings without the landlord’s permission.  The Ministry advised at that time, that despite many attempts to contact the landlord, contact had not been established. 

 

The Ministry provided weekly updates on its efforts to gain access to the old WMHC site.  On April 22, 2002, the Acting Deputy Minister wrote to the Assistant Commissioner and advised that, after many attempts to contact the landlord, including numerous telephone calls and a registered letter, a meeting was arranged.  At this meeting, the landlord indicated that he would be willing to consider allowing access to the Ministry, pending resolution of the labour situation.  The Acting Deputy Minister stated that “the Ministry does have a plan in place to conduct an immediate, thorough and appropriately search of the premises once permission has been obtained.”

 

The strike ended on May 6, 2002. As of the date of this report, four months later, the Ministry has still not been able to access the buildings in order to identify and secure any Ministry documents that might still remain on site and to determine whether there has been disclosure of personal information. The Ministry has continued its attempts to contact the landlord.  The Ministry advised me that a meeting with the landlord was scheduled for August 6, 2002 but he did not attend.

 

It should be noted that while the Ministry maintains that it is interested in gaining access to the remaining buildings to determine whether other ministry records remain unsecured, the Ministry claims to be unconvinced that even if additional ministry documents are found on the old WMHC site, they would contain personal information.

 

While for obvious reasons I too, have not attended at the other buildings, I was able to interview a fifth individual (Witness D).  This witness has access to all of the buildings on the old WMHC site.  Witness D was able to confirm to me that additional ministry records remain on the old WMHC site, but could not confirm whether there is personal information in the records. 

 

In addition, both Witnesses A and B stated that there are still many records remaining in Building #30.

 

CONCLUSION:

 

As I have indicated before in this report, an institution’s two priorities when faced with an unauthorized disclosure of personal information are: (1) to identify the scope of the disclosure and take steps to contain it; and (2) to identify those individuals whose personal information was disclosed and, barring exceptional circumstances, to notify those individuals accordingly.  Neither of these priorities has been satisfactorily addressed by the Ministry.

 

I have reached the following conclusions based on the results of my investigations:

 

The found records:

 

1.            A number of records contain personal information as defined in section 2(1) of the Act.

2.            Disclosure of the personal information in these records by the Ministry was not in compliance with section 42 of the Act.

3.            The Ministry has not notified any of the individuals to whom this personal information relates.

4.            The personal information was not disposed of in a secure manner as required by section 40(4) of the Act and Regulation 459.

5.            The disclosure occurred as a result of the move by WMHC to its current location.  While the Ministry had a procedure and protocol (Project Clean Sweep) in place, the emphasis was on records management and the reduction of unnecessary documents.  The Ministry’s protocol lacks the necessary detail, complete with checklists to ensure security, protection of personal privacy and accountability for such a move.

 

Additional unsecured personal information:

 

6.      There is credible evidence that leads me to a strong belief that more records containing personal information could remain unsecured on the old WMHC site.

 

 RECOMMENDATIONS:

 

1.            First and foremost, I recommend in the strongest possible terms that the Ministry utilize any and all remedies available to it and to the Government of Ontario generally to secure an appropriate order of the court to recover any documents remaining in the old WMHC site, in order to bring the Government in compliance with the privacy protection provisions of the Act.  In this regard, the Ministry should contact me if it requires the consents provided to me by Witnesses A, B and C referred to above.

 

2.            In furtherance of Recommendation #1, the Ministry should provide me with a report which:

•               outlines the steps taken to meet recommendation #1; 

•               includes a detailed accounting of the contents of any records found on the premises;

•               confirms that any individuals whose personal information is contained in the records have been notified of the disclosure of their personal information, subject to any exceptional circumstances which should be explained; and

•               confirms that the records will be retained until such time as all recommendations set out in this report have been implemented and we have advised that our file is closed.  At that time the Ministry may dispose of the records in accordance with its retentions schedule and in compliance with the Act.  

 

3.            With respect to the already found records, I recommend that the Ministry notify all individuals whose personal information is contained in the records, that their personal information was disclosed, and provide me with a report on the outcome. 

 

         Having made this recommendation, I accept that in circumstances such as these, where some records date as far back as 1977, there may be impediments to conducting a full notification; the Ministry will need to assess the records and make a determination. 

 

         Where the Ministry has notified individuals of the disclosures, its report to me should include:

 

•               details of  the number of individuals notified;

•               whether they are patients or staff;  and

•               a description of the content of the notices;

 

Where the Ministry has not notified individuals of the disclosures, its report to me should include:

 

•               details of the numbers of individuals not notified;

•               whether they are patients or staff; and

•               the basis on which it has determined that exceptional circumstances prevent notification.

 

The report should also confirm that the records will be retained until such time as all recommendations set out in this report have been implemented and we have advised that our file is closed.  At that time the Ministry may dispose of the records in accordance with its retentions schedule and in compliance with the Act.  

 

4.            I recommend that the Ministry establish an ongoing program of training for managers and staff at the WMHC with respect to the records in its custody and care to ensure the security of personal information.  This office’s report Moving Information: Privacy & Security Guidelines, should form part of the training program.  It contains guidelines on how to protect privacy before, during and after a move. In this report, we highlight the importance of policies and procedures for training staff, the use of checklists, the use of secure facilities for temporary storage and the retention and disposal of records.

 

5.      I recommend that the Ministry establish and/or review its own particular policies and procedures for the protection and secure disposal procedures of personal information.

 

The Ministry should provide me with proof of compliance with the above recommendations as follows:

 

1.            Recommendations 1, 2 and 3 by October 5, 2002.

 

2.            Recommendations 4 and 5 by December 5, 2002.

 

 

 

 

 

                                                                                                            September 5, 2002

Mumtaz Jiwan Mediator