Yukon’s health data found in pawn shop

WHITEHORSE, YK – Health and Social Services Minister Tracy-Anne McPhee (pictured) says her department has changed its case management system so that sensitive information can only be accessed through a secure portal.

Yukon’s health and social services minister says she is “confident” a recent data breach has been contained. However, the opposition says the government needs to explain its policies for handling sensitive information and what’s being done to improve them.

In early October, a Whitehorse man told CBC News he obtained a USB drive from a local pawn shop. Stored on the drive were confidential case files belonging to the territory’s Department of Health and Social Services.

CBC News viewed some files to confirm their authenticity and then deleted them. They included files from the family and children’s service branch, including case assessments, reports, budgets and personal contact information.

Health Minister Tracy-Anne McPhee confirmed the files were from the Family and Children’s Services, and said her department was made aware of the breach the afternoon of Oct. 13.

“Within 24 hours of being notified by the Information and Privacy Commissioner, we were confident that all information on the USB drive was recovered and secured,” McPhee said in a statement.

She said the USB drive is now “safely in our possession,” and that the government has confirmed with the three people known to have witnessed some of the contents of the device that they have destroyed any copies and have not disclosed any of the confidential information.

McPhee said the files were removed from the Health and Social Services system by a former employee who had ”abandoned” their belongings in a storage unit, which ended up being sold to a local pawn shop. She said the former employee was not authorized to have taken this information.

She said it affected 30 to 60 people but cautioned that wasn’t the final number, as work is happening at a “feverish pace” to identify all those affected. McPhee said the department planned to notify those affected by registered mail.

McPhee said the department will also provide affected people with “contact information and someone they can talk to at Health and Social Services,” and that it will be following up with a “personal phone call to those most affected.”

McPhee told reporters that the information on the USB drive ”is dated information,” and added in a statement later that it is sensitive in nature.

“On behalf of the Government of Yukon, I offer my sincere apologies to those impacted by this privacy breach,” she said in her statement. ”Ensuring that Yukoners’ personal information is protected and secure is of the utmost importance and we are taking this situation very seriously.”

McPhee said her department has made changes to its case management system, but didn’t specify when the changes were made. A spokesperson later told CBC News the changes started in May 2021 and were fully implemented by November that year.

“If anybody wants to access that [information], they must access through a secure portal with a password and an identifier,” she said, adding that information cannot be seen or removed from those systems without going through that process.