Privacy commissioner reviewing reported Ontario Health atHome data breach

CBC

7 hours ago

Both Ontario's privacy commissioner and Ontario Health are investigating a reported data breach affecting Ontario Health atHome, the province's home-care coordination service.
The incident may have exposed personal health information for at least 200,000 home-care patients, the Ontario Liberals alleged in a news release Friday morning.
The breach occurred on or around March 17 of this year but was not made public, the Liberals say.
"If exposed, this data can lead to identity theft, insurance fraud, discrimination, stigmatization, phishing, and blackmail," the news release read.
Speaking at an unrelated news conference on Friday, Ontario Health Minister Sylvia Jones said the breach involved a third-party vendor.
She said Ontario Health and Ontario Health AtHome are investigating the situation and will notify individual patients as needed.
Premier Doug Ford said the three-month delay in making the incident public will be part of the investigation.
"We'll find out where the gap is and why it wasn't brought to our attention a lot earlier," he said.
Privacy commissioner investigating
Liberal MPP Dr. Adil Shamji, an emergency room physician who represents Don Valley East, said he first sent a letter to the Information and Privacy Commissioner (IPC) on June 20 asking whether the incident was being investigated.
He said he did not receive a response and wrote a second letter to the IPC formally requesting an investigation on Friday.
The IPC is an independent office that oversees Ontario's access and privacy laws. It also investigates privacy complaints related to personal information.
Commissioner Patricia Kosseim responded to Shamji in a letter Friday, confirming the IPC had received a report about the incident.
"This matter is currently under review by our office," she wrote in the letter,.
Kosseim said the IPC cannot provide further details as the office is in the initial stages of reviewing the report.
Nearly one-third of all home care patients affected: MPP
In his letter Friday to Kosseim, Shamji said that nearly one-third of all home-care patients in the province had their data compromised in the breach.
"I feel compelled to follow-up because I am worried that Ontario Health atHome's failure to act on this issue represents a clear and present risk to patients," he wrote in the letter.
The news release from the Ontario Liberals said people affected by data breaches should be notified as soon as reasonably possible, typically within days to a few weeks.
Shamji is "demanding the immediate notification of impacted individuals and an explanation from Premier Ford for three and a half months of inaction," the release reads.
"This violation of personal health information adds to a growing list of Ontario Health atHome failures, including province-wide medication shortages, depleted supplies of vital home care equipment, and unacceptable delays in care," it said.