PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. PC-020063-1

 

 

Ministry of Health and Long-Term Care

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   PC-020063-1

 

MEDIATOR:                                                            Susan Ostapec

 

INSTITUTION:                                            Ministry of Health and Long-Term Care

 

 

INTRODUCTION

 

The Ontario Hepatitis C Assistance Plan

 

This privacy complaint relates to the Ontario Hepatitis C Assistance Plan (OHCAP).  In IPC Investigation Report PC-000011-1, the following background information was provided about OHCAP.

 

The Ministry of Health and Long-Term Care (the Ministry) administers the Ontario Hepatitis C Assistance Plan (OHCAP).  The OHCAP program provides compensation to certain individuals who can establish that they contracted Hepatitis C through the blood system.

 

Under the OHCAP program, a member of the public can request an application form from the Ministry.  Applicants are required to disclose, in detail, their medical history with respect to any blood transfusions they may have had during the time period covered by the program.  They are also required to sign a consent form, allowing the hospital where they received treatment to disclose hospital records to the Ministry for the purposes of determining eligibility.

 

Once the Ministry receives a signed consent and other required application documents, the Ministry initiates a search for hospital records.  The Ministry contacts hospitals and asks them to search for and send copies of all relevant records concerning the particular applicant to the Ministry.

 

Once the hospital records are received by OHCAP, the file is assigned to a Nurse Case Manager to obtain additional information through a questionnaire.  This additional information is particularly important if the blood records for an applicant have not been located.  Once the questionnaire is completed, the file is forwarded to the OHCAP Program Adjudicator to make a determination of eligibility based on the information in the file.  If an applicant is deemed eligible, compensation is paid.  If an applicant is deemed ineligible, a letter of ineligibility is sent to the applicant explaining the review process and relevant time lines.

SUMMARY OF COMMISSIONER-INITIATED PRIVACY COMPLAINT:

 

The Deputy Minister’s office notified the Information and Privacy Commissioner/Ontario (the IPC) by telephone of a privacy incident that occurred in the OHCAP program area.  Specifically, the Ministry advised, in writing, as follows:

 

On December 3, 2002, an individual (Applicant A) contacted the OHCAP infoline to inform [OHCAP] that he had received a letter belonging to another individual.  The letter contained the name, address and OHCAP file number of another individual [Applicant B], however the exterior envelope contained Applicant A’s correct name and address.  [OHCAP] took immediate steps to investigate the incident, contain and try to retrieve the information and to notify the affected individuals.  From their investigation it was learned that an error in mailing resulted from the switching of two courier labels.

 

On December 3 the OHCAP Program Coordinator contacted Applicant A and received verbal assurances that Applicant B’s information was not shared with anyone nor was the information duplicated in any way.  Arrangements were made with Applicant A to have Applicant B’s information picked up by courier and delivered back to OHCAP.  The OHCAP Coordinator attempted to contact Applicant B on the same day and learned that he had moved.  Applicant B was contacted the next day and notified of the mailing error.  A call to the courier company confirmed that the package to Applicant B was not delivered and the courier company was instructed to return it to OHCAP as soon as possible.  Last week the courier company returned the package to OHCAP and confirmed that it was never delivered to Applicant B.  Thus all of the information has been retrieved and is in OHCAP’s possession

 

To ensure that the error was contained, [OHCAP] immediately contacted the remaining eight applicants who were [couriered] packages on November 29^th.  Without revealing the issue of the breach, these applicants were asked if they got their package, if they understood the appeals process now open to them.  As a result of the telephone survey, no indication was given that information other than their own was forwarded to those persons.

 

With respect to the incident itself, the Ministry states that the “... error in mailing resulted from the switching of two courier labels”.  After discussing this matter further with the OHCAP Manager and obtaining more information about the incident, I am satisfied that the disclosure in question was inadvertent and was a result of human error.

 

The Manager explained that the employee responsible for courier mail also answers the OHCAP Infoline and, as a result, is usually on the telephone when matching labels with letters.  There are approximately one or two letters of ineligibility generated per day.  Given these circumstances, in order to try to avoid a similar occurrence in the future, it would be advisable that mail duties are carried out by an employee who is not on the telephone while performing this task.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act, states, in part, that “personal information” means recorded information about an identifiable individual.

 

The Manager provided me with a copy of Individual B’s documents sent to Individual A.  The information in the letter shows the name, address and OHCAP file number of Individual B as well as information pertaining to Individual B’s ineligibility.  The letter also contains two attachments.  One attachment is entitled “How to Request a Review of a Decision made by OHCAP”.  The other attachment is a form entitled “Request for Records Search”.   This is a Canadian Blood Services form which contains information relating to the analysis of blood units from hospital health records pertaining to Individual B.  Having reviewed the records, I find that the information provided to the applicant on how to request a review of an OHCAP decision is not personal information.  However, I find that the information in the letter of ineligibility and the search form clearly qualifies as “personal information” as defined in section 2(1) of the Act.  The Ministry does not dispute this. 

 

Was the disclosure of the “personal information” in accordance with section 42 of the Act?

 

Section 42 of the Act sets out a number of circumstances under which an institution may disclose personal information.

 

None of the circumstances set out in section 42 apply to the disclosure of the personal information in question.  Accordingly, the disclosure of the personal information was not in compliance with the Act.

 

CONCLUSION:

 

I have reached the following conclusion based on the results of my investigation:

 

1.  The information in question was personal information as defined in section 2(1) of the Act.

 

2.  The disclosure of the personal information was not in compliance with section 42 of the Act.

 

3.  The disclosure of this personal information was the result of human error. 

 

I am satisfied that the Ministry responded appropriately to contain the error and I commend the Ministry for taking prompt action to investigate the incident, retrieve the record and notify the individual whose personal information was disclosed. 

 

In view of the steps taken by the Ministry in response to this incident, no further action is necessary with respect to this matter and the file is now closed.

 

 

 

 

 

 

                                                                                                            June 19, 2003

Susan Ostapec Mediator