N.W.T. faces lawsuit over health data breach that could affect all residents

The Northwest Territories is facing a lawsuit over a stolen laptop containing medical files that could include information on every resident in the territory.

"I would be surprised if it's anything less than 100 per cent," said Steven Cooper, an Edmonton lawyer who has filed a statement of claim in the N.W.T. Supreme Court.

"The government of the Northwest Territories, despite repeated breaches, doesn't seem to know how to control this information."

The lawsuit stems from a government-owned laptop that was stolen from inside a parked vehicle in Ottawa in May 2018. The laptop has never been found.

On that computer were thousands of unencrypted medical files of people who sought medical attention in the territory, including visitors. It's not clear what time period the files cover.

The government has acknowledged that at least 80 per cent of the territory's residents were part of the breach.

A spokesman for the territorial government, which is in the middle of an election, declined comment. Damien Healy said the government hadn't yet received notice of the claim.

A statement of defence has not yet been filed.

Cooper said the government has released little information about what the files contained. Court documents say they contain data that easily identifies individuals' specific mental and physical health problems.

"People are really concerned about the fact that there's a lot of embarrassing personal information out there that they don't want to be made available on some database at some time in the future," Cooper said. "There's an equal number of people that are concerned about the misuse in terms of credit ratings or identity theft.

"The fear is causing discomfort in people. There is no other source of information that is as extensive as is the case here."

That kind of unease can linger, said Cooper. Hackers and scammers may use personal information in ways that may not be immediately obvious, or they can sit on it until victims let their guard down.

"Then they're all of a sudden going to release a bunch of credit card information or SIN numbers and use it five years from now."

Cooper suggested that the massive data breach is part of a pattern in N.W.T.

He points to a bagful of counselling records that were found in a municipal dump in Fort Simpson, a doctor who tried to download information on a few dozen patients and mistakenly received data from 4,000 people, and medical records being inadvertently faxed to a Yellowknife newsroom.

"Faxing private information to the CBC — not once, but twice — is probably the pinnacle of negligence," Cooper said. "We're learning about new (breaches) weekly."

CBC North has reported patient privacy was breached eight times in 2015-2016 alone.

The lawsuit alleges that the government breached it duty of care in allowing the information to be so vulnerable to theft and misuse.

"If you walk into a doctor's office in the Northwest Territories, it seems to me there's a reasonably good chance that information is going to find its way outside that office. It's Skip the Dishes for information," Cooper said.

"There's a higher standard of care about the protection of information of this nature."

The lawsuit names one person. Cooper said he and his colleagues have spoken with about 50 others interested in joining.

The N.W.T. does not have class-action legislation, but allows a similar legal route that Cooper hopes to pursue.

— Follow Bob Weber on Twitter at @row1960

© Copyright Tri-City News