The Vancouver Coastal Health Authority failed to adequately protect confidential health information, according to an audit report British Columbia's auditor general released today.

The VCHA's computerized health records system had “serious security weaknesses,” according to John Doyle's report, The PARIS System for Community Care Services: Access and Security.

The authority uses the system, started in 2002, to store information on a wide range of health services, including mental health and addictions, for the 620,000 people it serves.

Too many people could read the files, Doyle found. “All 4,000 users were found to have excessive access to sensitive and confidential client information,” it said. “In some instances, this included clients' full health information.”

Nor was the authority tracking who was using the database. “The system lacked essential security controls needed to detect and prevent unauthorized access or attacks,” it said. “There is a risk that inappropriate disclosure or theft of information could take place without VCHA's knowledge.”

Doyle said he was pleased with the “significant effort” the VCHA has demonstrated in addressing many of the problems.

Acting information and privacy commissioner Paul Fraser announced the report on his office's three-year investigation into the PARIS system, originally scheduled to also be released today, has been delayed to allow VCHA enough time to review and comment on the recommendations.

"The personal information contained in PARIS is highly sensitive," the announcement said. "It includes diagnoses as well as the case notes of physicians, nurses and counsellors about the treatment they provide to their clients."

Update: Health Minister Kevin Falcon was away from the legislature today and not immediately available.

“For us to succeed in using information technology in eHealth, the public has to have confidence that the information they provide health authorities is going to be used appropriately,” said New Democratic Party health critic Adrian Dix.

Doyle's report raises serious questions and is the latest in a series of blemishes on the province's move to computerized records, he said.

Andrew MacLeod is The Tyee’s Legislative Bureau Chief in Victoria. Reach him here.