Family’s medical records sent to stranger in error
Privacy watchdog investigating breach; MedRecords blames employee mistake
VICTORIA Saanich resident Manjeet Manhas, 52, got one of the shocks of his life this week when he learned that his comprehensive medical records since 2000 were sent in error to a stranger in Nanaimo, who telephoned him with the disturbing news.
His records cover about 85 pages. Another 25 pages with his son’s medical records were also sent to the Nanaimo man, along with those of several other people. Manhas, a Canada Post letter carrier, said he felt violated by the breach.
The records were mistakenly sent by MedRecords Distribution Association, a non-profit association that scans and stores medical records on behalf of physicians. MedRecords stored Manhas’s information when his physician retired last year.
He emailed the association in April, stating that his new doctor had not yet received his records as expected, but heard nothing back.
A lot of things went through his mind when he spoke to the stranger from Nanaimo. Worst-case scenario: “Imagine everything you talked to a doctor about in your life falling into the wrong hands.”
The records were on a compact disc, sent in error by registered mail on May 14 to Nanaimo and not discovered until recently. The Nanaimo man, who did not want his name published, said he was “just shocked” when he realized other patients’ medical records were in the same file as his own.
“I couldn’t believe it. I could not believe it. … Where is the oversight? I think I have five or six records for people.”
The Office of the Information and Privacy Commissioner for B.C. is investigating the breach.
MedRecord’s founder, Aiden Fernandes, said all patients involved have been told of the breach, which he attributed to human error. An employee burned a CD with the incorrect records. It should have been destroyed, but was sent out by registered mail instead of the corrected CD, Fernandes said.
Measures will be taken with the employee, he said, without disclosing them. A new protocol will be put in place to ensure such a breach does not recur, he said.
He declined to say how many patient records the association keeps. Its policy is to report breaches and this is the first time the association has faced such an issue in more than four years of operation.
MedRecords is endorsed by the Doctors of B.C., but it is not involved in its operation, said president Dr. Trina Larsen Soles in a statement.
“As a condition of our endorsement, MedRecords has obligation to implement and maintain safeguards for the security and protection of medical records consistent with all applicable legislation and to comply with all standards of practice and professional ethics requirements of the College of Physicians and Surgeons of British Columbia.
“We will be following up with MedRecords to ensure that these standards are being maintained.”
Erin Beattie, communications director for the Office of the Information and Privacy Commissioner, said that if it finds MedRecords failed to take reasonable security measures, it could order MedRecords to make changes to ensure compliance with B.C.’s Personal Information Protection Act.
No monetary penalty would apply in this situation. An individual would have to go to court on their own, she said.