Data Breaches: All's Not Lost, Even If Your Data Is (And If You've Taken Precautions)

As anyone who's ever left a USB key in a Kinko's knows, it's easy to lose a mobile device containing sensitive user information. As a recent statement from the Newfoundland and Labrador's Office of the Information and Privacy Commissioner (OIPC) shows, taking preemptive steps to make the user information on a mobile device more secure could protect the information – and your organization – if the device ever falls into the wrong hands.

The Incident

In June of 2015, someone at Eastern Health, the provincial health authority for Newfoundland and Labrador, lost a non-encrypted flash drive containing the names, Social Insurance Numbers, and identification numbers of some 9,000 Eastern Health employees. Luckily for Eastern Health, and its employees, the missing flash drive was ultimately found in a file folder and recovered. Even so, under section 15 of Newfoundland and Labrador's Personal Health Information Act, Eastern Health was required to notify OIPC of the loss,