Files on 39 addiction treatment clients found in Regina dumpster, privacy commissioner says

Saskatchewan privacy commissioner Ronald Kruzeniski speaks at a news conference in Regina on Monday, June 22, 2015.

A recent report from the province’s privacy commissioner says the Métis Addictions Council of Saskatchewan Inc. (MACSI) failed to take appropriate steps after patient treatment files were discovered in a recycling bin.

Commissioner Ronald Kruzeniski was alerted of the privacy breach on Aug. 5, 2022, after receiving a report that files with the information of MACSI patients had been found in a bin in the Douglas Park area of Regina, according to the March 15 report.

Office staff were sent to investigate, eventually recovering 174 pages of documents from the bin that included treatment details, contact information, birthdates, health card numbers and location of 39 patients, Kruzeniski says.

An interview with MACSI staff revealed the files were dumped sometime after lunch on Aug. 4, the report says.

“The records were dumped in an unsecured recycling bin, and anyone who came to the bin would have the ability to view or even take the MACSI records,” Kruzeniski said.

“MACSI lost total control of the records, including who could have potentially viewed or taken them from the bin.”

After learning of the discovery, staff at MACSI waited an entire week before searching the bin for additional records, the report says, meaning any medical records left behind could have been accessed by others.

This search of the bin was the only step the organization took to contain the privacy breach, Kruzeniski writes. The organization made no attempt to learn if the recycling bin had been emptied in the week between when staff learned of the breach and when they did a follow-up search.

MACSI also failed to notify the 39 people whose private information was breached, arguing they were vulnerable clients and did not have contact information, the report says.

Kruzeniski says the organization could still have posted notices in its offices and on its website.

“I find MACSI did not make enough effort to provide notification to affected individuals,” he said.

In investigating the privacy breach, MACSI told the commissioner the files were improperly disposed of due to human error. Papers had been placed on top of their shredder, which had a paper jam at the time.

“However, MACSI was not able to conclude how the materials went from being placed on top of the shredder to ending up in the recycling bin,” said Kruzeniski.