Big increase in number of NWT health privacy breaches

The number of health privacy breaches reported in the NWT nearly tripled in the past year, for reasons ranging from Covid-19 data mishaps to improvements in reporting.

Andrew Fox, the territory’s information and privacy commissioner since November 2020, set out the latest figures in an annual report made public in the legislature last week.

Fox’s office opened 234 files related to alleged breaches of the Health Information Act between April 2021 and March 2022, the report states. The figure for 2020-21 had been 87.

In his report, Fox said this followed a longer-term trend: the number of files being investigated by the commissioner’s office has increased sixfold since 2011.

He expressed concern that neither his own office nor government agencies may have adequate resources to handle so many files – but said the increase may not be entirely the result of things getting worse.

“The increase in new matters is likely due to an increased number of privacy breaches as well as more thorough reporting,” Fox wrote.

“Changes in operations, staffing, and training due to the pandemic likely caused some increase in actual privacy breaches. However, the increase in notifications is likely also due to better recognition and reporting of breaches.”

He said the territory’s health authority had “taken steps to improve awareness of staff about recognizing and responding to breaches, and its reporting process is also evolving and improving.”

Some Covid investigations still open

Still, there were areas in which Fox found significant fault. The handling of data by the NWT’s Covid-19 Secretariat, a temporary cross-departmental agency designed to address the pandemic’s impact, was among them.

Of the 234 health-related files opened, 55 related to the Covid-19 Secretariat.

“The Covid Secretariat ceased operations earlier this year, but investigations continue,” Fox wrote.

“Some of these breach events were significant: one instance of improperly addressed email affected over 1,000 individuals.

“Most of the privacy breaches that occurred within the Covid Secretariat were not reported by the Department of Health and Social Services in a timely manner. In some instances, months passed between the secretariat’s discovery of a privacy breach and notice to my office and the affected individuals. Investigation of these breaches has been further delayed by late final reporting and the need to seek further details regarding individual breaches and [the department’s] responses.”

Fox also touched on the longstanding issue of faxing healthcare records and the danger to privacy that represents, though he added that email was becoming just as significant a risk.

The NWT government has only just released its response to regular MLAs’ review of Fox’s last annual report. In that response, the territory said it recognizes fax machines are a problem but can’t completely phase them out.

The Department of Health and Social Services “has been reducing the use of faxing across the NWT over the past decade [but] the primary use of fax machines continues to be deeply engrained in the day-to-day flow of transmitting information across the health sector,” the territory wrote to a committee of MLAs.

“In some cases, legislation and regulations require signatures, and electronic documents must be printed, signed, and faxed as part of the workflow.

“Transmission of information using fax technology within the NWT ensures provision of health services for all business environments where there may be an absence of other means of timely communication. Between jurisdictions, fax technology provides timely communication to meet requirements enforced by provincial and territorial legal frameworks for management of personal health information.”

The territory said work is ongoing with other jurisdictions to decrease the need for faxing.

“Covid-19 brought additional pressures and challenges, which has also slowed the progress on planning to address the faxing reduction. HSS understands the importance and priority of this issue and is committed to better understanding the current use of faxing across the NWT HSS system, and to continue the work towards further reducing faxing,” the territory concluded.