By Katie Strachan
The Oshawa Express

Months after a USB device bearing the health records of more than 83,000 people was lost on Durham Regional headquarters land, the region says it has met the privacy commissioner’s order.
The USB key, which was allegedly dropped by a nurse states the region, was lost in December. It contained heath information of everyone who received a flu shot from H1N1 and seasonal flu vaccine clinics.
Just weeks later Dr. Ann Cavoukian, privacy commissioner, gave a series of recommendations the region was to follow. It had to prove compliance to her by Feb. 16.
Pat Jeselon and Ross Fraser, privacy and security consultants, say the region met Dr. Cavoukian’s orders by the Feb. 16 deadline.
The first of the commissioner’s orders was directed at Dr. Robert Kyle, the chief medical officer, says Fraser. Dr. Kyle was named the health information custodian.
The region was to ensure their mobile devices are strongly encrypted, which makes a file unreadable to anyone except those that have special knowledge for that particular file.
“The IPC (Information Privacy Commissioner) did not constitute what a mobile device was,” says Fraser, adding the privacy commissioner also didn’t specify the terms of ‘strong’ encryption.

Fraser says the region worked with the commissioner to develop a definition that would be satisfactory.
“In response we developed a policy on security and encryption,” he says.
Fraser says the region’s new encryption policy is simple and easy.
“We’ve designed the system so encryption is automatic. There are no decisions that need to be made,” he says, adding nurses often don’t have the time to choose where to save files, this program chooses for them.
All mobile computing devices and mobile media, like laptops and memory sticks, used by the region’s health department are all encrypted now as soon as they are put into the computer, say the consultants.
The privacy commissioner also ordered that vaccination clinics across the region stop collecting health card numbers and personal information except if it’s related to previous vaccines immediately.
“This was never a decision made by Durham Region,” says Fraser of collecting personal information.
The decision to collect heath card numbers was that of the Niagara Region, whom Durham received the immunization program from, he explains.
Directly after receiving the commissioner’s report the region stopped collecting health card numbers. It also revised the questionnaires that were given to the public at vaccination clinics.
Dr. Cavoukian also ordered Dr. Kyle to take the necessary administrative actions to ensure health card numbers that were collected at immunization clinics were destroyed. “That information was all securely wiped. I personally witnessed that,” says Fraser.

Personal information relating to priority status, when the H1N1 vaccines were only available to those with priority status, was destroyed as well.
While the region met the commissioner’s demands in time, Fraser says it will have to continue to work towards maintaining the orders.

“Now you have to go back and make sure everyone’s following it (orders). It could be a walkabout to make sure people aren’t displaying their passwords…like under keyboards,” he says.

Staff members from the region’s Corporate Information Services department are attending a mandatory training session in relation to the commissioner’s orders on Saturday.
While Fraser says the training is beneficial, the region must continue to re-train employees throughout their careers at the region, not just once when they are hired.
“It needs to be done more than once,” he says.
Throughout the process of developing encryption policies and other security policies, Dr. Kyle has been sharing the experience with other municipalities.
In fact, Dr. Kyle has passed on information learned to 36 health departments across the province, he says.
“Dr. Kyle has been very open and shown a great deal of leadership,” says Jeselon.
The next steps for Durham include finalizing the Private Policy and its framework, enhancing staff training and creating an awareness program for staff.
In addition, the region plans to hire an Information and Privacy Officer.
It must also continue to create and revise policies and procedures when required to ensure another breach doesn’t occur.
The region is sending a multi-page report to the commissioner with its responses to her orders.