Photo: Jacques Boissinot Archives The canadian Press
The auditor general, Guylaine Leclerc
The auditor general, Guylaine Leclerc, was concerned about the risk of misuse of confidential data in the hands of the Régie de l’assurance maladie du Québec (RAMQ) and Pension Quebec. The control of the activities of the staff of these two organizations, who have it access the privileged to such information, is insufficient, she said.
First of all, MEDICARE and Retirement-Quebec do not check systematically the criminal records of their employees, which is a problem, ” she says. Moreover, they do not revise sufficiently privileged access to the personal data, do not monitor closely their download and do not carry out adequately the follow-up security alerts-automated and newspapers.
“The supervision needs to be enhanced when the staff that have privileged access to download confidential data, and, as to the RAMQ to Retirement Québec “, argues Ms. Leclerc in a report tabled in the national Assembly, Wednesday. “Currently, users do not always need to obtain permission from their manager before proceeding with the download, and the managers do not perform systematic follow-up on what has been downloaded “, she says.
Gaps in the management of identities and access expose MEDICARE and Retirement Québec, and any other organization, to a risk of unlawful use of an access after the departure of an employee, a risk of destruction or modification of data without authorization, a risk of leakage of confidential data and risk of theft of the access by an unauthorized person.
The databases of the RAMQ contains personal information on approximately 8 million covered persons, including their names, medicare numbers and social insurance numbers. They also contain prescribed medication to 3.7 million participants in the public prescription drug insurance Plan and the providers of the standards Commission, equity, health and safety in the workplace (CNESST) as well as the wages paid to health professionals.
The data banks Pension Québec, which administers the Québec pension Plan, the pension plans of the public sector and the Allocation family, contiennentƒ income of Quebec,ƒ their family situation, in addition to the medical information of individuals eligible for disability pensions.
Other details will follow.
To see the video