Montreal clinic accidentally sent patient data to 300+ people in privacy breach

Philippe Quevillon, a patient at the GMF de Verdun, reacts to a recent email that left him in disbelief.

When Philippe Quevillon opened a recent email from his family clinic, he was left in disbelief.

“To my surprise, I was like, ‘Okay, here’s a whole spreadsheet of 315 patients.’ I have to assume, because I was on that list,” Quevillon told CTV News.

The list included confidential information such as names, last names, health insurance (RAMQ) numbers, phone numbers, and patient addresses from the Clinique universitaire de médecine de famille - GMF de Verdun.

“So, you know, enough [information] that, in the wrong hands, could definitely do some damage,” he said.

Quevillon then alerted the clinic of the breach and said he received a second email asking him to disregard the first one.

“That’s the last place I would expect that type of information to be leaked. Next to having our actual patient files sent out to each other, that’s as bad as it gets by my standards,” Quevillon noted.

“And I was a victim of bank fraud last year, so this really had me a little bit more concerned.”

In a statement, the health authority that oversees GMF de Verdun said the mass email was sent by mistake.

“The person responsible for sending it inadvertently sent the wrong document, attaching a list of patients instead of an attachment intended to explain our university teaching mandate to our users,” said a spokesperson for the CIUSSS du Centre-Sud-de-l’Île-de-Montreal.

The health authority said that it had taken immediate steps to protect the patients' information, including recalling the email.

“A second email was sent to the 300 users concerned to inform them of the situation and ask them to delete the attachment,” the health authority said, adding that an assessment is underway to ensure that no inappropriate use of the date has taken place.

Paul Brunet, chair of the Council for the Protection of Patients, said that situations like this one are exceptional and added that patients have recourse in the event their information is misused.

“By virtue of new legislation in Canada and Quebec, someone’s personal data is of the utmost importance, and someone can incur a lot of sanctions for that even though it is not done with bad faith,” Brunet explained.

For Quevillon, however, the damage was done.

“I don’t think you really can repair [this]. The insecurity that maybe certain people have to feel now because of what ifs.”