Patient records impacted by missing external hard drive

EDMONTON – Alberta Health Services (AHS) is notifying approximately 650 patients that their personal health information was kept on an external hard drive that went missing from a Cardiac Sciences outpatient clinical procedure lab at the Mazankowski Alberta Heart Institute in August 2019.

The missing hard drive could be linked to a theft that occurred inside the clinical procedure lab at the Mazankowski on August 5, 2019, but it wasn’t identified as missing until a few weeks later.

The theft at the lab was thoroughly investigated by AHS Protective Services and AHS Privacy, as well as by the Edmonton Police Service (EPS). The external drive has not been recovered and EPS has closed its investigation.The missing hard drive and theft of the other items do not impact patient care.

The external drive was unencrypted and non-password protected. Personal patient information accessible on the drive includes study date of cardiac mapping tests, patient names, gender, dates of birth, physician name and medical record numbers (not the same as an Alberta personal health care number).

“We know this news will be stressful for those affected and we apologize for any worry this may cause. We would like to note that the nature of the data on the drive would make it very difficult for someone to use just on its own,” says Dr. Mark Joffe, Vice President and Medical Director, Northern Alberta, AHS.

AHS takes the privacy and confidentiality of patient information seriously and has stringent privacy policies in place, including policies pertaining to the electronic storage of patient records.

“Certain mandatory encryption policies were not followed in this case, and that is unacceptable. The policies were reviewed with staff to prevent any future issues. Security measures and building access for statutory holidays have also been reviewed by AHS Security and new changes will prevent future issues with inappropriate access to the lab,” says Dr. Joffe.

AHS has informed the Office of the Information and Privacy Commissioner and Alberta Health of this incident.

Individuals receiving notification letters will be able to contact a dedicated call-line available through Health Link to ask any questions they may have.

Alberta Health Services is the provincial health authority responsible for planning and delivering health supports and services for more than four million adults and children living in Alberta. Its mission is to provide a patient-focused, quality health system that is accessible and sustainable for all Albertans.