Internal review to probe health ministry firings

Something went wrong: It remains to be seen to what extent any of the findings will be made public

But a close reading of (Privacy Commissioner Elizabeth Denham’s) report put most of the blame on the ministry for systemic failures regarding privacy and security policies.

VICTORIA

While the B.C. Liberals continue to say as little as possible about those firings in the health ministry two years ago, an internal investigation is quietly underway into what went wrong in the badly botched operation.

Lynda Tarras, head of the public service agency, is undertaking a full-blown review, aiming to determine how the thing went off the rails and what lessons can be learned for the future.

It’s an apt assignment for the human relations agency, given that the affair has been characterized, in and out of government, as the biggest HR debacle in the modern-day public service.

To recap, in September 2012, the health ministry announced the firings of eight staffers, medical researchers and contract workers, amid allegations of security breaches, mishandling of confidential data, and possible criminal conduct.

But this year, the ministry has been engaged in a systematic backdown, with out-of-court settlements, public apologies and, in two cases, reinstatement of those fired.

The choice of Tarras to oversee the review could raise eyebrows, since her public service agency would normally have a decisive role in personnel decisions that lead to firings or that necessitate reinstatement.

However, I gather her agency had minimal involvement in the firings, which were handled directly out of the health ministry after an internal investigation into allegations originating from an outside whistleblower.

The ministry stuck by the firings into 2013 and made court filings contesting the suits for wrongful dismissal. But after the votes were counted from that year’s provincial election, there was a change at the top of the health ministry, and not just because cabinet minister Margaret MacDiarmid was defeated for re-election in her Vancouver constituency.

Deputy health minister Graham Whitmarsh was out as well, departing government with a $250,000 severance package. His replacement, Stephen Brown, took on as a first assignment a review of the firings and resulting investigation.

At about the same time, Privacy Commissioner Elizabeth Denham issued her findings on what had happened in the health ministry.

Her June 26, 2013 report left no doubt that there had been three serious breaches of security regarding the handling of confidential health data: “Ministry employees were able to download large amounts of personal health data onto unencrypted flash drives and share it with unauthorized persons, undetected.”

But a close reading of her report put most of the blame on the ministry for systemic failures regarding privacy and security policies.

“At the time the breaches occurred, there was a lack of clear responsibility for privacy within the ministry. This was due, in part I believe, to a lack of clarity of roles and responsibilities following the centralization of some information access and privacy functions. Ministry privacy governance was further weakened by a complete lack of audit and review of employee and contractor functions relating to privacy. There were no mechanisms to ensure that researchers were complying with the privacy requirements, as stipulated in contracts and written agreements, and to ensure that ministry employees were taking appropriate privacy training and following privacy policies.”

She closed by issuing a halfdozen recommendations of the clean-up-your-act variety, atop a lament (“I am deeply concerned”) that the ministry had not already established proper procedures, 20 years into the new era of privacy protection initiated by the province’s landmark access-to-information legislation.

While the report deliberately did not “address criminal or civil culpability on the part of the ministry, its employees or contractors,” neither did it provide any indication that the security breaches were the result of nefarious intent. The new deputy minister of health would appear to have reached a similar conclusion regarding several of those that his predecessor placed before a firing squad.

For starting this year, Brown initiated apologies and out-ofcourt settlements with three of the ousted employees. Bob Hart and Malcolm Maclure were reinstated as well. A third, Ron Mattson, chose not to (in his words) return to work for a government that would treat its employees in such rough and unwarranted fashion. Other cases have been dealt with via union grievance procedures. One, that of co-op student and medical researcher Roderick MacIsaac, is beyond redress, for the distraught man killed himself four months after he was fired.

But I gather the internal view inside government is that MacIsaac should never have been fired, given that it happened just three days before the end of his term as a co-op student, in any event.

Whether any Liberal will admit that publicly is doubtful. The government is guarded because there are still two outstanding lawsuits arising from this affair — one from fired researcher Rebecca Warburton, the other from her husband Bill, who, though not fired, alleges his research work and reputation were harmed as well.

The government is also irate because two years after the document security breaches, it still hasn’t been able to re-establish access to confidential health data from Statistics Canada. As for the public service review, Tarras is scheduled to leave as head of the agency at the end of the month, so the report will likely be her last official act. But given the outstanding lawsuits and other considerations, it remains to be seen to what extent her findings or recommendations will be made public.