Privacy Commissioner's Order re: Laptop Theft

The Ontario Information and Privacy Commissioner released an order today (Order HO-004) to Toronto's Hospital for Sick Children following the theft of a laptop containing personal health information. Her closing comment: "There is no excuse for unauthorized access to personal health information due to the theft or loss of a mobile computing device - any PHI contained therein must be encrypted."

The Order goes into considerable depth concerning the obligations of Health Information Custodians with respect to a number of issues. Its worth the read. If time is an issue the press release provides a good summary.

Do No Harm!

In thinking about eHealth risk I am first drawn to Hippocrates' admonition to "do no harm". What harm can befall a person because of eHealth? The possibilities are limited and closely interrelated. The ones that come to mind are:

1. Harm to a person's physical and mental well-being - this is the classic "safety" issue. We can cause personal physical or mental damage to people because we don't build or use our eHealth systems properly.
2. Harm to a person's financial well-being - personal health information can be used to steal a person's identity, making them vulnerable to financial attack by identity thieves.
3. Harm to a person's reputation - which can impact physical, mental and financial well-being. Release of personal information can impact a person's social standing, cause varying levels of embarrassment, and result in stigmatization.

I've strained my brain and I am challenged to add to this list. Of course, this is from a human being point of view. Organizations, many of which have the status of "natural humans" in law can also be subject to such harms, though the physical and mental well-being issue only applies in a very limited sense (an event so serious may occur that the organization might go out of business, or die).

At this stage I'm more interested in the human impacts, because addressing human health, be it physical, mental, financial or reputational, is the whole point of implementing eHealth systems in the first place.

Comments are welcome.