Wet paperwork and mouldy boxes: Privacy Commissioner’s office investigates after patient charts destroyed in flood

A medical clinic in Ontario has run afoul of the province’s Office of the Information and Privacy Commissioner (IPC) after a flood destroyed more than 100 medical records at an off-site facility.According to the decision dated Jan. 13, 2026, the medical centre was found to have failed to appropriately assess the environmental risks to patient data, but the situation did not warrant a further investigation from the IPC, given the steps that the medical centre took to prevent a future loss.The medical centre, which has not been publicly named in the IPC documents, had custody of patient charts that were a part of a now-closed medical practice that the centre had taken over. While some of the patient charts had been digitized, the medical centre had placed the remaining paper with a third-party storage company.A patient had requested access to their paper medical charts and filed the complaint with the IPC after the medical centre failed to provide the charts. The medical centre said it was unable to provide the charge as the storage company did not respond to any phone calls or registered letters.However, on June 5, 2023, the storage company sent a letter to the medical centre informing that the files had been destroyed.“Unfortunately, the files were kept in the basement. There was a large flood . . .. All paperwork was completely wet, and boxes were covered in mold. We had no option but to professionally and securely destroy all files,” the storage company letter reads.Upon investigation, the medical centre informed the IPC that 102 patient charts were affected and that a notice was sent to the affected individuals. However, the medical centre did not provide the IPC with a copy of the notice, which should have also informed the affected individuals of their right to file a complaint with the IPC as required by the Personal Health Information Protection Act (PHIPA).“Despite my request, the medical centre did not provide me with a copy of the posted notices and I, therefore, did not have an opportunity to review their contents. Also, the medical centre did not confirm whether the affected individuals were informed of their right to make a complaint to this office,” IPC investigator John Gayle wrote. “Accordingly, I am not satisfied that the medical centre’s notice to affected individuals complied.”Furthermore, the medical centre had an obligation under PHIPA to ensure that potential privacy and security risks to patient data, including environmental risk.The service agreement signed between the medical centre and the storage company did say the storage company would “take all reasonable measures to protect the stored charts” and promptly notify the medical centre “in the event of unforeseen circumstances (e.g. natural disasters, flooding).” However, the IPC was not satisfied that the medical centre did enough to ensure adequate safeguards were in place to address environmental risks to the patient data. In addition, neither the medical centre nor the storage company conduct a privacy impact assessment (PIA).“The medical centre did not, before entering into the Agreement, define specific security requirements relating to how the storage area would be maintained to prevent environmental damage,” Gayle said. “Nor did the medical centre define processes for monitoring or evaluating whether the storage company was taking ‘all reasonable’ protective measures, or assess the storage company’s capacity to manage environmental risks.”On top of that, the IPC rejected the notion that flooding could be an “unforeseen circumstance,” given that the storage company’s letter clearly indicates that the files were stored in a basement. “While I make no findings about the specific storage practices employed by the storage company, this information indicates that the risk of flood damage was not merely theoretical,” Gayle wrote.But in the aftermath of this incident, the IPC noted that the medical clinic has since developed a formalized PIA process. The clinic also told the IPC it now requires third-party service providers to conduct their own PIA before entering into an agreement (with explicit definitions of privacy breaches in the agreement) and has scheduled periodic performance reviews and compliance checks.Under Part VI of PHIPA, the IPC has the power to conduct a formal review and issue legally binding orders to disclose evidence and compel information. But given these corrective measures, the IPC concluded there was no need to initiate such a review.“In the circumstances and having regard to the medical’s centre’s corrective actions and improvements to its privacy framework, I am satisfied that the medical centre has taken reasonable and meaningful steps to address the breach and reduce the risk of a similar loss occurring in the future,” Gayle said.

Wet paperwork and mouldy boxes: Privacy Commissioner’s office investigates after patient charts destroyed in flood

Register for free access or login.

Related Topics