LONDON, ONT. -- The Middlesex-London Health Unit (MLHU) is defending itself over a privacy breach earlier this year when papers and two computer hard drives containing personal information and personal health information were left behind at its former headquarters on King Street.
It happened during the move to its new location inside Citi Plaza in the spring. On April 23, Middlesex County employees discovered the computers and documents in a vault.
The MLHU conducted an internal investigation and says the items in question were left behind inadvertently.
Eighty hard drives were found and two of them contained personal information (PI) and personal health information (PHI). Two others contained user data but no PI or PHI. Two were corrupt and not readable, two more were encrypted and no user data was accessible. Another 72 were wiped and contained no data.
The PI and PHI on one of the drives included 35 referrals, and caseload information for 530 clients of the infant hearing and blind-low vision programs while the information on the other hard drive included the names and contact information of 150 MLHU volunteers.
The MLHU says it is satisfied that there was no viewing by Middlesex County staff or others and actions taken to contain the breach prevented any unauthorized use of the information.
The health unit says there was some client PHI in the paper documents left behind. Information includes, client lists related to a 270 person food poisoning investigation, a fax request for medical records and a fax immunization report for a school-aged child.
But the MLHU says it's confident no one viewed the PHI in the documents because the papers were stored in a secure location.
As a result of the breach, the health unit is in the process of implementing new policies and procedures to ensure electronic devices are disposed of securely and the data they contain is erased and destroyed.
