The NWT’s privacy commissioner says the territorial government must learn from a breach during the disbandment of the Covid-19 Coordinating Secretariat.
Andrew Fox issued a review report last month regarding an incident in June 2022 in which more than 2,000 Covid-19 isolation forms were found within an unlocked filing cabinet in an NWT government warehouse.
Fox said while the Covid-19 Secretariat no longer exists and the privacy breach occurred more than two years ago, his recommendations could help NWT government agencies during future department changes or reorganizations.
The secretariat was a unit within the health department that was responsible for managing the NWT government’s response to the pandemic. It was dissolved when the territory’s Covid-19-related public health emergency was lifted on April 1, 2022.
According to Fox’s report, forms completed by 2,065 people who had stayed at Covid-19 isolation centres in Yellowknife between August 2020 and April 2021 had been forgotten in the filing cabinet.
Advertisement.
Advertisement.
The forms contained people’s names, addresses, phone numbers, email addresses, Covid-19 test results and symptom checks.
The cabinet had been kept in the hallway of the secretariat’s office in the downtown Centre Square tower. Fox said while the door to that space was locked and required a passcode, anyone entering the office could have accessed the files, including maintenance staff and visitors.
Once the secretariat vacated the office, surplus furniture left behind – including the filing cabinet – was moved to a warehouse. Warehouse staff then discovered the forms inside the cabinet.
Fox said while there is no evidence anyone unlawfully access those records, the way they had been handled created risk.
Advertisement.
Advertisement.
He concluded the health department had failed to follow the NWT government’s policies, procedures and standards for records management and did not have a formal plan to ensure private information was properly managed during the secretariat’s disbandment.
While the department said it competed “a sweep” of the office before the filing cabinet was moved, that did not include checking the contents of the filing cabinet. The department said it did not complete a final walk-out inspection of the office.
“The failure to complete a walk-out inspection is one of the root causes of this privacy breach,” Fox wrote.
“It is reasonable to assume that had a proper walk-out inspection been completed where every item of furniture was checked for records, the forms would have been discovered, and this privacy breach could have been prevented.”
Fox recommended that in future, the health department determine and follow all policies, procedures, standards and best practices for records management.
He said the department should also take care to document the retention and destruction of records and plan ahead for reorganizations like this.
