Case study

The stolen laptop ^(13–15)

The theft happened on 4 Jan 2007, between the hours of 7:30 pm and 11:00 pm at a parking lot in downtown Toronto, Canada.

A doctor at the Hospital for Sick Children (Sick Kids) took a laptop out of the hospital so that he could continue analysing his research data at home. Unfortunately, someone broke into his minivan and stole the laptop while he was away. It was concealed under a blanket between the front seats because his van had no boot.

The data

The laptop contained records from ten research studies. Five were prospective studies (~157 patients) and five retrospective studies (~2700 patients). Out of all participants, 300 were still active patients of the hospital at the time. The rest were former patients. Many had grown up into adults and one-third had died.

Research subjects’ names, hospital IDs, medical conditions and for some, HIV statuses and family members’ information, were among the data that was stored in the laptop. All these data were also backed-up in the hospital’s main server.

All data would be accessible by logging in to the laptop using a single password made out of eight alpha-numeric characters.

All ten studies had been approved by the hospital’s research ethics board. Requirements to obtain consent had been waived for the five retrospective studies.

The Hospital for Sick Children. SickKids notifies study participants of stolen laptop [Internet]. 2007 [cited 2019 Feb 22]. Available from: http://www.sickkids.ca/AboutSickKids/Newsroom/Past-News/2007/SickKids-notifies-study-participants-of-stolen-laptop.html

Cavoukian A. Order HO-004 [Internet]. Information and Privacy Commissioner, Ontario; 2007 [cited 2019 Feb 24]. Available from: https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/item/135025/index.do

Stolen laptop - Media transcript prepared by Media Q Inc. exclusively for NSERC [Internet]. CBC News. Toronto; 2007. Available from: http://tcps2core.ca/files/module1/Stolen_Laptop_media_transcription_EN.pdf

Answer the following questions.

Multi-choice

Question

Is this a serious threat to research subjects’ privacy?

Answers

Option 1

Yes

Option 2

Feedback

Correct. This is a serious information security threat.

The single-layer password protection (laptop login) is not sufficient as it could be guessed, hacked or cracked easily with readily available software. The loss of the laptop could lead to unauthorised access to sensitive and identifiable personal health information, which could be used for illegitimate purposes such as fraud or identity theft. ⁽¹⁴⁾

Cavoukian A. Order HO-004 [Internet]. Information and Privacy Commissioner, Ontario; 2007 [cited 2019 Feb 24]. Available from: https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/item/135025/index.do

Incorrect. This is a serious information security threat.

The single-layer password protection (laptop login) is not sufficient as it could be guessed, hacked or cracked easily with readily available software. The loss of the laptop could lead to unauthorised access to sensitive and identifiable personal health information, which could be used for illegitimate purposes such as fraud or identity theft. ⁽¹⁴⁾

Cavoukian A. Order HO-004 [Internet]. Information and Privacy Commissioner, Ontario; 2007 [cited 2019 Feb 24]. Available from: https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/item/135025/index.do

Solution

Correct Option (Feedback)
Wrong (Feedback)

Multi-select

Question

If you were the doctor / researcher, who should you inform about this incident? (Choose all that apply)

Answers

Option 1

The police

Option 2

The hospital’s administration

Option 3

The hospital’s research ethics committee

Option 4

Research subjects in the prospective studies

Option 5

Research subjects in the retrospective studies

Option 6

None of the above

Feedback

You should report the theft to all of the following:

The police: This is so that they can try to recover your laptop as soon as possible.

The hospital: This is because the hospital is the custodian of its patients’ information and thus has the overarching responsibility of safeguarding patients’ information.

The research ethics committee: This is because the incident involves research. The committee should work with you and the hospital to minimise any potential harm to research subjects.

All subjects: This is regardless of whether consent to use their information has been waived or not. All affected subjects should be notified about the potential risk that their personal information might fall into wrong hands.

Solution

Correct
Correct
Correct
Correct
Correct
Incorrect

Case study continued →