Pubdate: Fri, 11 Aug 2017
Source: Vancouver Sun (CN BC)
Copyright: 2017 Postmedia Network Inc.
Contact:  http://www.canada.com/vancouversun/
Details: http://www.mapinc.org/media/477
Author: Dan Fumano
Page: A1
Referenced: Nanos poll http://mapinc.org/url/uqsktO25

ANOTHER DISPENSARY BREACH, AND STILL NO POT LAW

Sensitive patient data supplied to a Vancouver cannabis dispensary has
been either mishandled or - according to the shop's owner - stolen, a
situation that again highlights the confusion over the regulation of
retail pot.

Most people in weed-friendly Vancouver, it seems, don't have a problem
with dispensaries. A Nanos poll of Vancouverites last year found only
14 per cent supported banning medical dispensaries.

But the city's decision to take the lead in Canada by licensing a
still-illegal industry has contributed to a regulatory haze where many
in Vancouver - including cannabis users and non-consumers alike, and
even those involved in the weed business - have expressed confusion
about the state of affairs while Canadians await expected federal
legislation to legalize nonmedicinal marijuana.

A tipster recently contacted Postmedia to say he'd found a computer
memory card in a Vancouver alley, containing more than 1,000 photos of
people taken inside a west-side dispensary, and digital copies of
private medical documents. Postmedia has reviewed the memory card to
confirm its contents, but is not identifying the dispensary because it
was not immediately possible to confirm how the disk was obtained. The
tipster who provided the disk said he was unsure if it ended up in the
alley due to negligence or a criminal act that led to the memory card
being removed from the dispensary.

On Thursday, after Postmedia told the dispensary's owner of the data
leak, he reported it to the Vancouver police.

The shop owner said all patient information is stored on a secure,
internal system, and "the only way someone would be able to get this
information is stealing it from us."

Whether a case of negligence or theft, it raises questions about the
oversight of a multimillion-dollar business that's against the law as
far as Ottawa's concerned.

The incident follows a breach last year at another Vancouver
dispensary, which led to an investigation by B.C.'s privacy watchdog
and a public warning from Health Canada. In October, Postmedia
reported sensitive patient data had been publicly viewable through the
website of an east Vancouver dispensary called the Vancouver Pain
Management Society.

Breaches of sensitive information have happened before at Canada's
medical labs, hospitals and government agencies. But one thing
differentiating dispensary cases is Ottawa opposes, rather than
regulates, these businesses. That raises the question of who holds
dispensaries accountable if they are negligent with medical data.

The Office of the Information and Privacy Commissioner for B.C.
investigated last year's breach. Reached this week, an office
spokeswoman said the investigation had closed, but the office "does
not disclose the results of our investigations and therefore cannot
comment."

Asked whether the office could issue sanctions or discipline
organizations found to be breaching privacy rules, spokeswoman Jane
Zatylny said "the commissioner can order an organization to stop
disclosing the information."

Last year's dispensary breach (which, like this week's leak, was
brought to the attention of Postmedia by a tipster) prompted Health
Canada to issue a statement "to reiterate that all dispensaries
selling cannabis are illegal (and) function outside of Health Canada's
regulatory framework. … As such, it would be inappropriate for Health
Canada to comment on the record-keeping and management practices of
these illegal entities."

Responding to this week's leak, a Health Canada spokesman said last
year's statement "still applies."

Similarly, a City of Vancouver spokesman said this week the city's
position hasn't changed since last October's statement, which said:
"Oversight on patient data would not fall under the jurisdiction of
the city (as with health clinics and hospitals in the city) and so it
is not referred to in our bylaws."

But it could be argued the city's decision to create a licensing
structure for illegal businesses has given them a veneer of legitimacy.

The two Vancouver dispensaries involved in the recent data breaches
are working their way through the city's licensing program. In the 10
months since the Vancouver Pain Management Society breach, different
levels of government have stuck to their positions that dispensary
data oversight isn't their responsibility, and a cloudy situation's
not getting any clearer.
- ---
MAP posted-by: Matt