The provincial government sent the personal information of some New Brunswickers to the wrong addresses in error in a medicare mailing mix-up.
That includes the social insurance numbers of at least seven people, the Department of Health confirmed to CBC News, because older medicare numbers used to be social insurance numbers.
A yet-to-be-determined number of individuals also had their names, dates of birth and addresses mailed to the wrong place.
“We don’t have that level of detail at the moment,” department spokesperson Meghan Cumby said in an email.
The government is “contacting everyone who would have been scheduled to receive mail on the days in question,” she said.
But about 365 households could be affected.
The problem was discovered last Thursday when a resident contacted Service New Brunswick teleservices “to advise they had received someone else’s information,” Cumby said.
Although the Department of Health is responsible for issuing medicare cards, it relies on Service New Brunswick to help process and send the cards to residents.
“After a second incident, Medicare determined this required a more in-depth investigation,” Cumby said.
The government announced the problem in a news release late Friday, saying medicare “learned” that information “may have recently been sent to the wrong addresses, potentially affecting about 365 households.”
Some individuals may have received other people’s medicare information, along with their own, it said.
Shelley Tofflemire, who lives in the western New Brunswick community of Beechwood, said that’s what happened to her. She received a letter last Thursday indicating that her new medicare card would be “forwarded … shortly,” and that she could use the letter in the interim to obtain medical and hospital services.
It includes the her name, address, date of birth, medicare number, effective date and expiry date, along with the same information for each member of her household, Tofflemire said.
But someone else’s letter was behind hers too, she said, calling it a “huge data breach.”
“It has enough information for identity theft, I believe,” she said.
At first Tofflemire thought it was an isolated incident and that the pages must have just gotten stuck together, but then she saw posts on social media about it.
“As soon as we became aware of the issue, we rectified it and have begun work on mitigating the error for those impacted,” Local Government Minister Aaron Kennedy, who is also minister responsible for Service New Brunswick, said in the news release, without elaborating.
CBC News requested an interview with Kennedy, but Service New Brunswick spokesperson Mark Taylor said, “There is nothing more to add at this time.”
New Brunswick’s ombud has been notified, and anyone affected can expect medicare to contact them with further information and instructions, according to the release.
“Protecting the personal health information of New Brunswickers is of utmost importance,” Kennedy said.
Social media posts by some people indicated that when they called to alert the province about receiving someone else’s personal information they were simply advised to discard the information without being asked whose information they received. The Department of Health spokesperson said that was a directive provided by the Service New Brunswick agent.
“The normal practice would be that they are given instruction to return the correspondence to Medicare,” Cumby said.
“In this case that information was not communicated properly.”
Bill Hogan, the health critic for the Official Opposition, called the situation “disappointing” and said it should “not to be taken lightly.”
“It’s extremely important information and due diligence is extremely important,” he said.
“To make sure that we don’t send people’s private information to the wrong places is, you know, a primary concern.”
Hogan, who is the MLA for Woodstock-Hartland, is calling on the government to get to the bottom of what went wrong and put measures in place to ensure it never happens again.
Ombud Marie-France Pelletier was unavailable for an interview but in an emailed statement said the Department of Health, as a “health care custodian,” is obligated under the Personal Health Information and Protection of Privacy Act to notify her office and the affected individuals when there is a privacy breach.
“In cases where we receive a privacy breach notification, we review the file to determine if personal health information has been stolen, lost, disposed of in an unauthorized manner, or disclosed to or accessed by an unauthorized person,” Pelletier said.
“If a breach has occurred, the health care custodian is expected to contain the breach, evaluate the risks, notify impacted individuals, and work towards prevention of future instances.”
If someone thinks that their personal health information has been mishandled, or if they have received a privacy breach notification, they can contact her office by emailing [email protected] or calling toll free at 1-888-465-1100, Pelletier added.
