Clients notified of privacy breach at Child and Family Services

Some clients of Child and Family Services on P.E.I. have been notified by registered letter of a security breach involvingtheir personal information.

The letter, dated Aug.6, was sent by the Department of Social Housing and Development to clients whose electronic files were affected. The province said "fewer than 10" clients were affected, but did not provide an exact number.

The files included "client notes, current life circumstances and current orpast child-protection issues," according to the letter.

"We're discouraged that this did occur," said Sean Morrison, director, Child and Family Services. "We certainly apologize that this was something that the public is having to be notified and we understand that people tend to lose trust in situations like this and that's something that we are going to put some practices into place and continue to have practices in place to ensure that this doesn't occur again."

One of those practices includes conducting more random audits of who is accessing client files.

'Makes me very nervous'

In this case, Morrison said, it was an employee who accessed the files. That employee does have access to some files, but had no work reason to access the specific files involved in the breach.

The employee has been disciplined, he said.

A full investigation has been initiated, said Morrison, which should be complete in a few weeks. He addedthat "at this timethere is no evidence that any of the information was disclosed to anyone else."

The breach did not include any access to health records or financial information, according to the province.

One client who received the registered letter saidthe incident has left her with unanswered questions.

"It makes me very nervous that someone out there may now have sensitive information regarding my children," the client wrote to CBC. "So I am left wondering who ... was so curious about me and my children."

CBC has agreed to keep the name of this client confidential given the nature of the breach.

The province sent notice of the breach and of thefollow-up investigationnow underway to the office of the P.E.I. Information and Privacy Commissioner. Notice was not required under P.E.I. law, because the breach does not involve health information.

According to privacy commissioner Karen Rose, the move was voluntary and proactive by the province.

She told CBC News that her office will offer advice as the investigation continues. If, at the end of the process, any clients lodge a formal complaint with her office, the commissioner would start a formal report on the incident.

More P.E.I. news