Ontario Health Minister Silvia Jones says an investigation is underway into a reported data breach at a third-party vendor amid claims that the personal health information of approximately 200,000 Ontarians may have been accessed.
Liberal MPP Adil Shamji issued a news release on Friday in which he claimed that a breach involving the data of Ontario Health atHome patients occurred on March 17 but has not been disclosed to the public.
In his release, Shamji called on the information and privacy commissioner to investigate the breach and demanded that Premier Doug Ford provide an explanation for “three-and-a-half months of inaction.”
Asked about the matter during an unrelated news conference on Friday, Jones confirmed that an investigation is ongoing.
Jones, however, did not directly respond to a question on whether private medical records were in fact accessed.
“Ontario Health is absolutely investigating right now. We have a division that focuses on any potential cyberbreach and it is standard operating (procedure) that we will notify (the public) if there has been any form of breach to individual patients but that investigation is going on right now,” she said.
In a subsequent statement, a spokesperson for the Ministry of Health said there is supposed to be a process that should be followed in cyberbreach incidents, including identifying when it happened and notifying the government.
“The fact that this process was not followed is unacceptable,” the spokesperson said.
“Minister Jones has directed Ontario Health atHome to work with the vendor to immediately notify impacted patients and to take steps with each vendor to ensure this never happens again.”
Ontario Health atHome is an organization that co-ordinates access to health care support at home and in the community.
In a letter sent to Information and Privacy Commissioner Patricia Kosseim, Shamji claimed that the breach may have compromised the health records of “nearly one-third of all homecare patients in our province.”
In a letter sent in response to Shamji’s request, the IPC confirmed that the matter is “currently under review” by its office.
The IPC added that it would be “premature” to comment on the breach further, including when the government was first made aware, while still in the “preliminary stages of review.”
Shamji, for his part, said that he notified the PC government about the breach on June 20, however during a media availability on Friday Ford seemed to suggest that he was not previously aware of the matter.
“As the minister just said they are doing an investigation and that will come out and we will find out where the gap is and why it wasn’t brought to our attention a lot earlier,” he said. “Health records are sacred in Ontario. Anyone who breaches health care records needs to be fired immediately, they need to be gone, charged, that is what needs to happen here in Ontario.”
