Health minister impatient for privacy-breach update

Health Minister Fred Horne sounded a note of frustration Tuesday that no one has yet provided him with a progress report on the response to Alberta’s largest-ever breach of personal information, involving the health data of some 620,000 patients of Medicentres Canada.

Horne said he has yet to hear from either the company or the privacy commissioner, who is conducting an investigation into the breach.

“I haven’t been provided an update by anyone,” he said. “I don’t even have any information to suggest those 620,000 people have been contacted personally. ... I’m anxiously awaiting some confirmation that people have been notified.”

The breach occurred early last fall when an unencrypted laptop belonging to a Medicentres consultant was stolen or lost. On the laptop was a database containing the names, birthdates, health card numbers and diagnostic codes of patients who visited Medicentres in Calgary or Edmonton between May 2, 2011, and Sept. 19, 2013.

Even though the company became aware of the incident within days, Horne and the public were not informed until mid-January.

Medicentres said it decided to wait because it wanted to first conduct an internal review to make sure clients’ information was protected in the future.

The company printed a small notification of the breach in daily newspapers, and set up phone lines for concerned patients to call, but did not indicate it planned to contact those affected.

Horne said his office has not been in touch with Medicentres. “I haven’t heard that the laptop has been recovered, so I’m sure there are people out there who think they may have been affected who are concerned about what’s happened to their personal information.

Candace Cook, a spokeswoman for the privacy commissioner, said it would be improper to provide an update on the investigation to Horne or anyone else while it is still underway. She said the probe is a priority and the goal is to wrap it up as soon as quickly as possible.

A spokesperson for Medicentres could not be reached for comment.