The office of the privacy commissioner found these records at a recycling facility. (submitted)

By Susan McNeil

Privacy breach

Doctor’s records improperly disposed

Dec 23, 2022 | 12:00 PM

Patient records from a newly closed medical practice were not properly disposed of the privacy commissioner has ruled.

Dr. Lalita Malhotra, who retired earlier this year, failed to have all records shredded by a company that deals in secure shredding and some ended up whole in a recycling facility.

“Dr. Malhotra states that she accepts full responsibility for what occurred and appears to understand where she erred. Multiple factors contributed to the root cause of this privacy breach,” reads the ruling by privacy commissioner, Ronald J. Kruzeniski.

In August, staff from Kruzeniski’s office were alerted by Crown Recycling that what appeared to be patient records were coming through their recycling depot.

His staff immediately began an investigation, and alerted paNOW.

Riderville

A LOT Going on This Week

22m ago

Sentencing adjourned

Sentencing decision reserved for La Ronge manslaughter case

16h ago

Missing persons

11-year-old girl reported missing

17h ago

Normally, Malhotra’s office shared shredding services with a nearby pharmacy but with her retirement and the closure of the office, the volume of records to be disposed of was much higher.

Once the privacy commissioner’s staff contacted Malhotra, they learned she hired help to deal with the closure.

“Dr. Malhotra explained that they normally use confidential shredding (one used with Pharmasave), but there was not enough room, so MOA (medical office assistant) and their partner disposed of the records in Greenland’s dumpsters thinking they would be shredded,” reads the ruling.

The commissioner’s office collected about 55 banker’s boxes of records from the recycling facility. Another 45 boxes were still in Malhotra’s office on Central Avenue.

Another 140 boxes of records were being sent to a secure storage facility in Ontario in addition to the ones being disposed of locally.

According to the MOA who was sorting the records, the ones that were to be destroyed belonged to people who had passed away or not visited the clinic for more than six years.

Because of how the breach happened, the commissioner’s office said it cannot confirm if all of the dumped records were found as they were floating loosely in a pile with papers from other businesses.

The commissioner found that Malhotra did not take adequate steps to contain the breach, did not provide notice and did not do enough of an investigation following the breach.

He did find that she took adequate steps to stop future breaches and that she has a plan to store or destroy any remaining records.

Starting on December 5, she is required to provide individual notification where she can and she must also publicly notify people of the breach with an advertisement in the Prince Albert newspaper.

Malhotra has also hired a registered nurse to handle the destruction of any remaining documents and has hired Crown to obtain and destroy those records in accordance with the Privacy Act.

—

susan.mcneil@pattisonmedia.com