Data breach may have exposed 200,000 home-care patients' information, say Ontario Liberals
Ontario's privacy commissioner and Ontario Health are investigating a reported data breach affecting Ontario Health atHome, the province's home-care coordination service.
The incident may have exposed personal health information for at least 200,000 home-care patients, the Ontario Liberals alleged in a news release Friday morning.
The breach occurred on or around March 17 of this year but was not made public, the Liberals say.
"If exposed, this data can lead to identity theft, insurance fraud, discrimination, stigmatization, phishing, and blackmail," the news release read.
Speaking at an unrelated news conference on Friday, Ontario Health Minister Sylvia Jones said the incident involved a third-party vendor.
She said Ontario Health and Ontario Health AtHome are investigating the situation and will notify individual patients as needed.
Ministry spokesperson Ema Popovic later told CBC Toronto that Ontario Health atHome has been directed to take steps "to ensure this never happens again."
"Our government expects all service providers to uphold the highest standards of patient care, security and confidence. This includes taking immediate steps to identify when there has been a cyber breach and to notify the Ministry of Health immediately," Popovic said in an email.
"The fact that this process was not followed is unacceptable."
Premier Doug Ford said the three-month delay in making the incident public will be part of the investigation.
"We'll find out where the gap is and why it wasn't brought to our attention a lot earlier," he said.
Privacy commissioner investigatingLiberal MPP Dr. Adil Shamji, an emergency room physician who represents Don Valley East, said he first sent a letter to the Information and Privacy Commissioner (IPC) on June 20 asking whether the incident was being investigated.
He said he did not receive a response and wrote a second letter to the IPC formally requesting an investigation on Friday.
The IPC is an independent office that oversees Ontario's access and privacy laws. It also investigates privacy complaints related to personal information.
Commissioner Patricia Kosseim responded to Shamji in a letter Friday, confirming the IPC had received a report about the incident.
"This matter is currently under review by our office," she wrote in the letter.
Kosseim said the IPC cannot provide further details as the office is in the initial stages of reviewing the report.
Ontario Health atHome notified the commissioners' office about the breach on May 30, the office said in an email.
Under Ontario legislation, health information custodians are required to report certain breaches to the office and notify people if their personal health information is stolen, lost or used or disclosed without authority, the email said.
CBC Toronto has reached out to Ontario Health AtHome for comment.
Nearly one-third of all home care patients affected: MPPIn his letter Friday to Kosseim, Shamji said that nearly one-third of all home-care patients in the province had their data compromised.
"I feel compelled to follow-up because I am worried that Ontario Health atHome's failure to act on this issue represents a clear and present risk to patients," he wrote in the letter.
The news release from the Ontario Liberals said people affected by data breaches should be notified as soon as reasonably possible, typically within days to a few weeks.
Shamji is "demanding the immediate notification of impacted individuals and an explanation from Premier Ford for three and a half months of inaction," the release reads.
"This violation of personal health information adds to a growing list of Ontario Health atHome failures, including province-wide medication shortages, depleted supplies of vital home care equipment, and unacceptable delays in care," it said.
The reported data breach comes after Ontario Health atHome's CEO was fired in January following persistent supply problems in the sector.
In September, the company launched new supply contracts for the delivery of medical items, but the move left some patients — including people in palliative care — without critical supplies.
cbc.ca
