Privacy breach at Prairie Mountain Health could affect more than 1,500 people

Hey there, time traveller!
This article was published 29/05/2017 (3082 days ago), so information in it may no longer be current.

More than 1,500 people were potentially affected by a privacy breach involving an internal website used by Prairie Mountain Health.

The breach of the regional health authority’s website, which is also used by Emergency Medical Services, was discovered April 5 and involved patient information regarding ambulance transportation records by EMS staff from 2013 to this year.

“It remains inconclusive on whether the records were actually accessed,” Prairie Mountain Health CEO Penny Gilson said in a statement Monday. “The information at risk of compromise included demographic and clinical information regarding clients and demographics and limited employment information.”

Gilson said 1,176 clients and 453 Prairie Mountain Health and affiliated employees in the northern part of the RHA are at-risk. The Brandon-based RHA covers a large area of western Manitoba.

“It is our impression that the intent of the ‘hack’ was not targeted at accessing this information but rather to infect and transmit a virus into files maintained within this website,” the statement says. “Although the likelihood is low, based on how this information was stored on the site, we cannot exclude the possibility that identifiable personal and personal health information may have been, at minimum, viewed by the attacker, and/or copied.”

Gilson said the information involved could not be easily extracted for further use, was limited to select files and would have required going through individual files and transferring, in the case of client information, handwritten information.

Written notifications were sent out to the affected RHA and affiliated staff April 6. Letters to affected patients were sent out from April 12 until approximately May 19 as current contact information was confirmed, the statement says.

“Any time there has been a compromise of personal or personal health information, we remain concerned,” Gilson’s statement says. “However, PMH carried out our best efforts to notify impacted individuals as soon as reasonably possible so that any necessary precautions could be taken.”