Investigation finds that, while the collection and disclosure of information was authorized, a school division did not have reasonable security arrangements in place to protect the information it had collected
Frank Work, Information & Privacy Commissioner, publicly released an Investigation Report concerning the Alberta Mental Health Board’s (AMHB) disclosure of health information to the Northern Lights School Division # 69 (NLSD) concerning a student’s suicide attempt.
The Commissioner’s Office determined that the AMHB’s disclosure of health information was authorized by the Health Information Act, as the disclosure was made for the purpose of providing continuing treatment and care in an effort to ensure the safety of the student. The Office determined that the NLSD’s collection of health information was authorized by the Freedom of Information and Protection of Privacy Act. However, the Office determined that the school did not have reasonable security arrangements in place to protect against unauthorized access to the information that had been collected.
The Office made a number of recommendations concerning protection of the privacy and security of student personal information within the school’s electronic information system. The school division was also asked to complete and submit a privacy impact assessment.