Records containing personal health information of one individual were accessed by an unauthorized person as the records were erroneously left on public transit.
Resolved through informal resolution. The health information custodian invested in secure remote access technologies and agreed to revise its privacy policy to provide clear guidance on safeguards when transporting personal health information.
The IPC contacted the affected individual directly, as the records did not identify an originating health information custodian. The health information custodian, once identified, also notified the affected individual.
