LONDON, Ont. - A memory stick containing the records of 4,500 kids has gone missing from a speech and hearing clinic at UWO, a thumb-sized example of how ever-smaller digital technology is heightening security risks.
Included among the records on the tiny storage device are 11 years worth of names, addresses, phone numbers, birthdates, doctor information, school and child-care information.
Also on the stick are 142 OHIP numbers.
The privacy breach should "never, ever, ever" have happened, said Ontario's information and privacy commissioner.
"We've said this repeatedly, and obviously the message isn't getting through: If you are a health-care facility of any kind, you never transfer identifiable data onto a portable device such as a USB or a laptop," Ann Cavoukian said Monday.
"You don't back it up to a little flimsy device that is easy to lose or be stolen. Think about the possibilities for identity theft," she said.
The records are from the tyketalk and infant hearing programs, administered by the Middlesex London Health Unit at the H.A. Leeper Speech and Hearing Clinic at the University of Western Ontario's Elborn College.
The missing records are from 1999 to 2010.
Staff at the clinic realized the USB key was missing early in February after space was "rearranged," said Janice Deakin, UWO's provost and vice-president academic.
But while staff have known for more than two months, letters to the parents of the 4,500 kids only went out Monday.
"Your mind is spinning a bit," said one worried parent, Marnie Merritt, whose two daughters are clinic clients.
"I'm grateful we know, but why are we finding out through a friend, through the newspaper? Shouldn't the organization taking care of our kids be contacting us? Shouldn't they be a little more careful?" she asked.
Worries about identity theft -- possibly now swirling for thousands of parents who've had their kids in the clinic's programs -- would have been eliminated if staff had encrypted the information on the missing USB stick.
"Once you put information on a little key, you can lose it -- it's easier to store (information), it's easier to lose it and it's easier to steal it," said Richard H. Irving, a York University professor of operations management, who specializes in health-systems management.
He said the risk of losing information is growing as information-holding devices become smaller and more convenient.
"We've got huge, huge amounts of risk," he said. "Think about issues where somebody finds somebody else's USB or smartphone left behind at Starbuck's. There is potential for all kinds of compromise.
"The tablet computers, the smaller, lighter they get -- the more convenient they are, the increased risk that data will be compromised because you carry them around, you bring them more places."
In his data management class, Irving tells students to keep tight control of sensitive information.
"If you have a USB key with a lot of sensitive data on it, you have one of two options -- encrypt the thing or store it securely."
All UWO health clinics are expected to follow those same rules, said Deakin.
Leeper staff informed university officials about the privacy breach March 31. After an investigation that included campus police, UWO officials reported the situation to the office of the privacy commissioner April 12.
"Campus police have done a full investigation . . . and certainly we are still working with clinic staff to try to understand what went wrong," said Deakin.
"All I know is that it (the missing stick) was being kept at a work station."
She said UWO is investigating why a requirement to encrypt information that is transferred didn't happen in this case.
University officials are "very upset." she said.
"We regret the fact that it happened, and there are not any excuses to be made here. We understand how completely upsetting this will be to the public," she said.
Jennifer.obrien@sunmedia.ca
Twitter.com/obrienatlfpress
