Pubdate: Sat, 09 Jun 2007
Source: Sudbury Star (CN ON)
Copyright: 2007 The Sudbury Star
Contact:  http://www.thesudburystar.com
Details: http://www.mapinc.org/media/608
Bookmark: http://www.mapinc.org/find?136 (Methadone)

SECURE NETWORKS VITAL TO PRIVACY

Ontario Information and Privacy Commissioner Ann Cavoukian's decision 
not to reprimand a local methadone clinic for a breach of privacy is 
appropriate, but the issue serves as an omen on a much grander scale 
than health care.

It is a warning to anyone who uses a wireless network.

Cavoukian reviewed an incident involving Brian Dressler Medical 
Professional Corp., which runs a methadone clinic in the city. 
Methadone is used as a treatment for people dependent on certain 
drugs, often heroin.

Clients who visit the clinic for methadone treatment consent to be 
supervised - in this case, by cameras - while they provide urine 
samples. This is standard procedure for methadone clinics to ensure 
samples are not tampered with.

However, the clinic used a wireless link to monitor the cameras, and 
that link was intercepted by someone in a nearby vehicle that uses a 
camera to offer a better view of the road while backing up.

That situation is unacceptable. The Personal Health Information 
Protection Act places responsibility for protection of private health 
information - which includes monitoring of urine samples - on the 
facility collecting it.

When the clinic was made aware of the situation, it immediately shut 
down the cameras, arranged for a hard-wire hook-up, posted a notice 
to clients advising them of the problem, and notified the College of 
Physicians and Surgeons to request it caution other clinics of a 
potential problem.

All these are responsible actions. Cavoukian noted the clinic's 
speedy and comprehensive response to the situation once it became 
aware of the problem as the reason for her decision not to issue a reprimand.

However, the issue of wireless communication and the implications it 
has remains. Cavoukian said the "reasonable person test" - meaning 
what would the average person think - would leave someone "horrified."

Said Cavoukian: "An image of a person providing a urine sample in a 
washroom. They would be horrified."

But it goes much further. First, while the clinic did not record the 
image, someone else intercepting it could. An unscrupulous person has 
many possibilities. The image could be posted on the Internet, taking 
the embarrassment to a whole new level. Or that person could approach 
the client and threaten to notify employers who might not know about 
the client's methadone treatments - and by implication, possible 
dependence on drugs.

It's easy to see how what, at first, might seem like simple 
embarrassment can increase in magnitude into a life-altering 
situation. As Cavoukian noted in her report: "Because wireless 
communication technology transmits information across many frequency 
bands, it is susceptible to interference and interception.

"It operates on the same principles as a commercial radio station. 
Just as one may accidentally or inadvertently tune in to a distant 
radio station, personal health information, wirelessly transmitted, 
without security and privacy precautions, may be 'tuned in to' or 
received by unauthorized individuals.

"Since there are a limited number of frequency bands legally 
available for transmission, the risk of inadvertent interception is 
relatively high, and poses a significant threat to privacy."

Pretty scary stuff when you consider how many people in Greater 
Sudbury use wireless networks on their home computers, many of them unsecured.

It is up to all users of wireless networks, whether protecting the 
privacy of others or in their own homes, to take steps to secure 
their networks, and ISP providers should go to great lengths to 
ensure such a procedure is easy and universal.
- ---
MAP posted-by: Jay Bergstrom