Another piece of evidence dribbled out this week about the Health Ministry firings, in the form of a response to a freedom of information request.
The few dozen pages don’t provide anything new about the government’s epic change of heart over the long-running issue. It terminated contracts with eight researchers in the coldest way possible, then gradually started backtracking and wound up apologizing or paying damages to most of them, with no full explanation to anyone as to what was going on.
Ombudsperson Jay Chalke is busy investigating the mystifying case, so it will be up to him to try to provide an explanation.
What the document released this week does is illustrate officials’ mind-set during the first part of the story, leading up to when they brought the hammer down on the researchers. It shows that a full year after the dismissals, the internal view was that the Health Ministry was dealing with major problems in data handling.
The document is headed “Internal Review, Pharmaceutical Services Division,” and is labelled as a confidential initial draft for discussion, dated Sept. 26, 2013. Several key parts of it are redacted for personal-privacy reasons. But enough of it was released to show how seriously the top brass had taken the case.
The background was a complaint to the auditor general in March 2012 about inappropriate data access, irregular procurement, contracting and research-grant practices and preferential treatment in employer-contractor relations in the division. It was forwarded to the ministry, and the internal investigation started. Later on, the Finance Ministry’s comptroller general started a separate investigation. (Parts of it were released three weeks ago, but it’s so redacted it’s incomprehensible.)
The internal review released this week said the key findings involved “a number of lessons learned on what needs to be accomplished to improve policies and processes for employee, researcher and contractor data access to improve data security and privacy protections.”
It said after the initial complaint, the ministry did a preliminary review and found further action was warranted. The formal investigation began in May 2012 and by July it reported to the deputy minister with some interim findings. Some of the employees were suspended and contracts cancelled. People were fired as the investigation progressed, leading to September 2012, when the whole issue was made public.
The internal review said that in January 2013, the ministry notified 35,480 affected individuals of a privacy breach involving their personal information and also published a general public notification of two other privacy breaches.
The summary of findings is heavily redacted, but the conclusions that were released include a “disparity” between the development of research contracts and the resulting information-sharing agreements. There was limited information on references and background details from university contractors. Employees were “using their access to ministry data to support colleagues in their research/contracting endeavours without proper authorization to use the data.”
The internal review said that resulted in “major privacy breaches.” Seven other findings were censored.
Based on the internal review and some of the other investigations underway by different agencies, including the information and privacy commissioner and the comptroller general, there was a push to tighten procedures. More than 280 managers got mandatory security training. All health divisions inventoried how sensitive data are stored, and data warehousing was upgraded.
The review lists no fewer than 42 recommendations on data handling, overhauling every process.
In short, it’s an outline of what was perceived to be a catastrophic breach of privacy guidelines set up to protect personal information used in health research. It includes a litany of serious problems uncovered, so many that it takes four single-spaced pages to list the recommendations needed to correct all the problems.
The enduring mystery is how that great big scandal evaporated completely over the next two years. Second looks were taken, and different conclusions drawn. An independent lawyer rapped the internal review for being unfair to the researchers.
The government started backing down, and offering large cash settlements. The only researcher left out in the cold at this point is Roderick MacIsaac, who killed himself after being fired.
All the serious problems in the report seem to have turned to dust, leaving the impression they were never that serious in the first place.
