The source of a privacy breach that saw the personal health information of 91 patients released to the press remains a mystery following an investigation.
In April 2017, a document that was part of the auditor general’s report into MRI management services in Manitoba was leaked to several media outlets. The report contained names of Manitobans who potentially received preferential MRI scans for non-medical reasons, including patients of influence and those covered by private insurance, such as professional athletes.
READ MORE: Professional athletes, WCB members given MRI priority in Manitoba: report
The auditor general’s report had been given to the Winnipeg Regional Health Authority in 2016, before it was leaked.
Due to the serious nature of the breach, the Manitoba ombudsman launched an investigation under the Personal Health Information Act. The goal of the investigation was to determine what happened, who committed the breach, to review how the WRHA handled the situation, to identify factors that may have caused the breach and to come up with ways to reduce future risk.
“When an intentional privacy breach such as this one occurs, it takes away the control we have over how and with whom our personal health information is shared, and it erodes public trust in a system that is supposed to protect our privacy,” said acting ombudsman Marc Cormier in a news release.
The report on the investigation, released on April 23, 2019, says the ombudsman was unable to determine the source of the breach or how whoever is responsible obtained the personal health information. It also remains unknown whether the leak originated from the WRHA.
Because the cause of the breach is unknown, the report was unable to provide how this specific leak could be prevented. The review does provide ways organizations can minimize risks when using personal health information such as implementing security safeguards and limiting the amount of personal information that gets used.
The review also found the WRHA responded in an appropriate manner to the privacy breach.
- With files from CTV’s Josh Crabb and Katherine Dow
