You are using an older browser version. Please use a supported version for the best MSN experience.

Information leaked in data breach was 'dated,' says Yukon health minister logo 2022-10-18 Joseph Ho
Health and Social Services Minister Tracy-Anne McPhee says her department has changed its case management system so sensitive information can only be accessed through a secure portal. © Philippe Morin/CBC Health and Social Services Minister Tracy-Anne McPhee says her department has changed its case management system so sensitive information can only be accessed through a secure portal.

Yukon's health and social services minister says she is "confident" a recent data breach has been contained. However, the opposition says the government needs to explain its policies for handling sensitive information and what's being done to improve them.

Last week, a Whitehorse man told CBC News he obtained a USB drive from a local pawn shop. Stored on the drive were confidential case files belonging to the territory's Department of Health and Social Services.

CBC News viewed some files to confirm their authenticity and then deleted them. They included files from the family and children's service branch, including case assessments, reports, budgets and personal contact information.

Health Minister Tracy-Anne McPhee confirmed the files were from the Family and Children's Services, and said her department was made aware of the breach the afternoon of Oct. 13. 

"Within 24 hours of being notified by the Information and Privacy Commissioner, we were confident that all information on the USB drive was recovered and secured," McPhee said in a statement Tuesday.

She said the USB drive is now "safely in our possession," and that the government has confirmed with the three people known to have witnessed some of the contents of the device that they have destroyed any copies and have not disclosed any of the confidential information.

McPhee said the files were removed from the Health and Social Services system by a former employee who had "abandoned" their belongings in a storage unit, which ended up being sold to a local pawn shop. She said the former employee was not authorized to have taken this information.

She said it affected 30 to 60 people but cautioned that wasn't the final number, as work is happening at a "feverish pace" to identify all those affected. McPhee said the department plans to notify those affected by registered mail by the end of the week.

McPhee said the department will also provide affected people with "contact information and someone they can talk to at Health and Social Services," and that it will be following up with a "personal phone call to those most affected."

McPhee told reporters on Monday that the information on the USB drive "is dated information," and added in a statement later that it is sensitive in nature.

"On behalf of the Government of Yukon, I offer my sincere apologies to those impacted by this privacy breach," she said in her statement. "Ensuring that Yukoners' personal information is protected and secure is of the utmost importance and we are taking this situation very seriously."

McPhee said her department has made changes to its case management system, but didn't specify when the changes were made. A spokesperson later told CBC News the changes started in May 2021 and were fully implemented by November that year.

"If anybody wants to access that [information], they must access through a secure portal with a password and an identifier," she said, adding that information cannot be seen or removed from those systems without going through that process.

Investigation underway

This is the second time in weeks the government has had to answer questions about Yukoners' privacy. Early in the Yukon Legislature's fall sitting, the Yukon Party probed the government for why it took more than three weeks to inform students and families their personal information had been mistakenly emailed to an unintended recipient.

Party leader Currie Dixon was measured in his comments Monday as he awaited findings from the privacy commissioner's investigation.

"There's best practices that the Information and Privacy Commissioner advises the government on and in this particular case, it appears that either those best practices weren't followed, or they weren't in place to begin with," Dixon said.

Meanwhile, NDP leader Kate White said the government needs to say what kind of training and support workers are given to handle personal information. She also wants to know how often breaches like this latest one happen.

"I think the unfortunate truth is, Yukon Government has shown that they are not capable of keeping people's personal information," White said.

"They've shown not just once but twice in a very public way that they are not good at keeping this information. That they're not good at storing it. That they're not good at keeping it secure — and that's a problem."

image beaconimage beaconimage beacon