Abstract

In 2007, the Hospital for Sick Children experienced a serious privacy breach when a laptop computer containing the personal health information of approximately 3,000 patients and research subjects was stolen from a physician-researcher's vehicle. This incident was reported to the information and privacy commissioner of Ontario (IPC). The IPC issued an order that required the hospital to examine and revise its policies, practices and research protocols related to the protection of personal health information and to educate staff on privacy-related matters. This article outlines the hospital's response to the breach and to the commissioner's order, and the hospital's ongoing journey to create a culture aware of and accepting of the right to privacy of personal health information.