Auld Lang “Send”: let’s end email blunders and resolve to do better in 2022

How many of us have accidentally pressed “send” on an email to the wrong person?  It happened to me several years ago when my flight was cancelled and I sent a late-night email to my husband from the back of a very dark cab, letting him know I was on my way home from the airport. I signed, “Love you” at the end with x’s and o’s as I typically do, only to find out I had sent it to the wrong Ken! I was mortified of course, and the VP of a large company at the time never looked at me quite the same after that.

Have you ever sent a group email with all recipients’ addresses visible in the “To” box?  I did that just last year when I sent out our first annual family holiday newsletter and forgot to use the blind carbon copy (BCC) field. Luckily, they were all very close family and friends and no one seemed to mind, though you could be sure, I did not make the same mistake this year!

Neither of these mishaps caused any harm, thank goodness, but in different circumstances, such simple mistakes can have devastating impacts, particularly when the sensitive personal information of others is involved.

Misdirected emails are a very common source of privacy breaches due to unauthorized disclosure of personal information. In the health sector, the number of breaches resulting from these types of incidents has grown from just over 430 in 2018, to more than 960 in 2020. In 2020, the first year of mandatory breach reporting for the child and family services sector, close to 50 per cent of privacy breaches were due to misdirected emails.

My office routinely receives calls from the media and the public about breaches of personal information due to misdirected emails and some of these incidents have ended up in the news. Some incidents have involved a mass email where all the email addresses were entered into the carbon copy (CC) field instead of the BCC field, revealing not only the names and email addresses of everyone it was sent to, but also their common health status or some other personal attribute that could be deduced from the subject of the email. As recent examples, the vaccination status of specific staff members who received a group email reminding them of the importance of getting vaccinated or of undergoing regular antigen testing in the absence of proof of vaccination. Other incidents have involved unencrypted documents containing the personal information of individuals that were attached to emails and sent out to mass email lists.

Errors are part of human nature, and sending out an email with the wrong attachment or to the wrong recipients is probably not new to most of us. But mishandled emails can cause harmful embarrassment or humiliation for the individuals whose personal information is involved and can expose them to significant risks such as identity theft, cyberattacks, discrimination, and possibly social stigmatization. The consequences for employees who commit the error can also be quite serious, including termination of employment and disciplinary action by professional associations. Organizations can face fines, civil lawsuits, and reputational damage resulting from a loss of public trust in their ability to keep personal information secure.

These kinds of privacy breaches should serve as a reminder to every organization of how important it is to have explicit policies and administrative safeguards in place when handling the personal information of individuals. Employees need to be trained and reminded to be acutely aware of potential privacy risks and follow proper policies and procedures to avoid privacy breaches. Just as flight crews are trained to protect their passengers by systematically checking and rechecking basic security measures like seatbelts, emergency doors, and equipment before take-off and landing, so too must other employees be vigilant about how they format people’s personal information before pressing “send” via email.

When it comes to sending emails, there are relatively simple actions that can be taken to prevent privacy breaches. First, check and double-check the recipient address. Make it a habit to go over the names before hitting send and make sure they are in the right field — BCC instead of CC — if you are sending to multiple recipients. If you have documents or spreadsheets that contain the personal information of individuals, they should be encrypted with strong passwords. That way, even if they are mistakenly attached to an email or sent to the wrong person, unauthorized persons cannot read them.

The IPC’s fact sheet on Communicating Personal Health Information by Email highlights some important safeguards for protecting personal information that can be applied any time information is sent by email.

By remaining vigilant against privacy risks and having the right technical and administrative safeguards in place, you can help prevent your organization from becoming the next news headline. While making mistakes may be a part of human nature, so is learning from them.

Patricia