The office of B.C.’s privacy commissioner is investigating what could be dozens of privacy breaches involving sensitive medical information sent to an incorrect fax number provided by a Victoria medical imaging office.
The privacy office has opened a commissioner-initiated file, which allows it to examine the breaches without waiting for an individual to file a complaint, said spokeswoman Cara McGregor.
The move was prompted by a story in Wednesday’s Times Colonist about a Victoria couple who received more than 200 pages of faxes detailing medical conditions, complete with patients’ names and MSP and phone numbers. The faxes were meant for West Coast Medical Imaging at 1900 Richmond Ave., whose fax number was incorrect on some letterhead.
Leslie and Barry Wilson said they have tried for years to get the problem solved, but were met with what they characterized as indifference. They said the privacy office suggested that they could fax the documents to the office, while an employee of West Coast Medical Imaging told them the situation would be rectified.
The most recent fax arrived last week.
Janet Menu, a manager with West Coast Medical Imaging, said Wednesday that the lab would conduct an investigation but did not want to comment further.
The privacy office does not have the power to enforce notification of patients whose privacy was breached. Commissioner Elizabeth Denham has proposed changes that include mandatory notification for private-sector breaches. The legislation is being reviewed by a special committee of the legislature.
McGregor, the privacy commissioner’s spokeswoman, could not speculate on what actions the office might take regarding West Coast Medical Imaging. “It would be premature to discuss enforcement or penalties when we have only just begun looking at this issue.”
Only two cases of misdirected faxes containing medical information were brought to the attention of the Office of the Information and Privacy Commissioner in the past year out of 96 reported privacy breaches, McGregor said. There were only five such cases in the previous two years.
Island Health completes investigation, is working to prevent future breaches
Island Health has finished its investigation into a privacy breach after a woman’s health records were sent to a downtown Victoria business instead of her surgeon.
The business’s director, Rachelle Keeley, said it was the fifth time confidential medical records had been faxed to her office. The faxes were sent by the booking office for medical scans at Victoria General Hospital.
Steps to prevent such transmissions in the future have been taken, said Island Health spokeswoman Sarah Plank Wednesday.
The faxes were meant for a local surgeon, whose number differs by one digit from that of Premiere Suites Limited.
Keeley said her staff repeatedly phoned the booking office and the surgeon trying to get the faxes to stop.
The surgeon said his office had not been contacted.
The health authority’s investigation confirmed that three faxes were sent to the incorrect number between February 2013 and December 2014, each from a different Island Health medical imaging office.
The Dec. 4 document showed that the last digit of each number became difficult to read after the document had been faxed back and forth between the surgeon’s office and VGH.
The patient has been told of the breach by Island Health’s privacy office.
The VGH medical imaging office has programmed the correct fax number for the surgeon into its speed dial, and the technology department has come up with ways to prevent faxes from being sent to the incorrect number from any Island Health number, Plank said.
Staff have been made aware of the need to contact the health authority privacy office if they are notified of misdirected faxes, she said, while Island Health is continuing to work on technological solutions to reduce the potential for human error.
Plank urged anyone receiving Island Health faxes in error to contact its privacy office.
Identify theft a concern for Langford businessman who has received WCB faxes
Trevor Peirce of AcroVoice Solutions Inc. in Langford said his home-based business has received two or three medical faxes a year since 2010 from WorkSafe B.C. The most recent fax came in the summer.
“The details that have been sent to us include patients’ names, home address, phone number, date of birth, CareCard number, summary of a workplace injury, and a claim number. It also has the patient’s signature … everything a person would need [for an] identify theft,” said Peirce, who said he deletes the information.
He said he has repeatedly contacted WorkSafe B.C. and its call centre about the faxes, which he thinks are meant for a hospital on the mainland.
“They did consistently ask us to destroy the fax but didn’t seem interested in the details they’d need to ensure it doesn’t happen again, such as our fax number or the name of the patient whose information they’d sent us,” he said.
His business receives faxes electronically and they are automatically sent by email to his staff. Peirce said they probably still exist in the company’s backup.
“I had hoped to have been taken a bit more seriously when reporting this to them. Especially when they were informed on subsequent calls that this wasn’t the first time we’ve received faxes from them,” he said.
“I had thought that there were regulations in place that required breaches of privacy to be investigated, but perhaps I was overly optimistic.”
WorkSafe B.C. could not be reached for comment.
