Ontario's information and privacy commissioner is investigating after a clear plastic bag containing documents with patient names and medication information was left at the curb outside a London walk-in clinic.

One patient whose information was in the bag said she's furious the papers weren't shredded.

"I'm upset that they've done this," Jennifer Ebel told CBC News. "You put responsibility on the medical profession to ensure your privacy is upheld and there are laws to state that they must be upheld. I would love to know why this happened."

Byron resident Jennifer Ebel was shocked to learn her medical records were put out on the curb in a clear plastic bag outside a medical clinic she visited last year: 'I would love to know why this happened,' she said. (Andrew Lupton/CBC)

A document with Ebel's name, address, phone number and prescription information was found inside a bag among recycling last week at the curb outside Clinicare, a walk-in clinic on Wonderland Road near Viscount Road.

The bag was discovered by a staff member from MyCare pharmacy, which is located next door to Clinicare in the small shopping plaza.

Some of the documents in the bag were ripped in half but in some cases, they were still readable.

CBC News contacted Ebel after finding her name, home address, phone number and medication information on one of the documents that had been ripped once in half.

"They just tore the script in half and left my medical records visible," said Ebel. "I want to know what they can do to ensure that no one can steal my identity."

Patient information sent to Clinicare was left at the curbside outside the walk-in clinic in this clear plastic bag. (Andrew Lupton/CBC)

Clinicare is owned by Dr. Naeem Hafiz Muhammad. He is also the only doctor who currently operates out of the clinic.

CBC News spoke to Muhammad at the clinic on Tuesday, and he admitted the documents were not properly disposed of. After he was shown photos of the documents taken by CBC News, Muhammad said they weren't full patient medical records, but in fact fax cover sheets sent to his office from pharmacies.

Still he says they should have been shredded.

"This should not have happened," Muhammad said. "I talked to my staff this morning and we have started implementing that no paper with patients' name should go out without going through the shredder."

He said it was a mistake that his office staff put the papers at the curb among papers to be recycled.

"As a doctor, anything that happens at my clinic, I'm responsible for," he said. "I do not expect as a patient myself my information to be on the road like that. I don't think it's going to happen again."

Muhammad said he's been contacted by staff from Ontario's Information and Privacy Commissioner's office and will co-operate with their investigation.

Rules call for secure disposal

Ontario's Personal Health Information Protection Act requires health providers — including doctors — to handle patient documents in a "secure manner," but shredding isn't specified in the act.

However Ontario's Information and Privacy Commissioner Brian Beamish told CBC News that his office has sent out directives to health care providers, calling on them to shred all documents with patient information before they're thrown out.

Dr. Naeem Muhammad says he's spoken to his staff, reminding them that documents with patient information must be shredded. 'I take full responsibility,' he said. 'I don't think it's going to happen again.' (Andrew Lupton/CBC)

"Consistently our message is that recycling without paper shredding is not secure disposal of patient records," said Beamish. "It's very clear that if you have paper records, they need to be shredded and shredded in a manner that they cannot be reconstituted prior to going to recycling."

Beamish said typically the improper disposal of patient information is the result of carelessness or negligence.

Staff at the pharmacy next door took the documents to London Police, but said they opted not to investigate.

In a statement to CBC News, London Police Const. Sandasha Bough said personal privacy breaches are not policing matters and instead fall within the jurisdiction of the Information and Privacy Commissioner.

Beamish said he can understand if police aren't willing to get involved because a criminal offence in cases like this often requires proof the improper disposal was intentional "and that's often missing in these cases," he said.

In cases where there's evidence the improper disposal was more than an oversight, Beamish said his office can ask the Attorney General to get involved.

Breaking provincial rules for handling patient records could leave doctors facing fines of $100,000 for individuals or $500,000 for organizations.

Stiff penalties for non-compliance

The College of Physicians and Surgeons of Ontario (CPSO), which regulates the province's doctors, has a policy that requires shredding of medical records before they're disposed. Doctors are also required to ensure records "are protected from theft, loss and unauthorized use or disclosure, including copying, modification or disposal."

Penalties for improper handling of records range from a requirement that doctors take a CPSO-mandated course, right up to licence suspensions.