‘This will be the norm’: hackers go after clinic’s health info

A Winnipeg medical clinic is notifying patients about a possible breach of their personal health information after RCMP said its data system may have been hacked.

In a Jan. 9 letter to patients, stamped personal and confidential, the New Norwood Medical Centre wrote that while “there is no confirmation that any individual patient records have been publicly disclosed or misused,” it appeared there may have been unauthorized access to their system, as well as the Bison Clinic, on Nov. 10.

The letter says the clinic became aware of the issue Dec. 8. It noted it is working with law enforcement and cybersecurity experts to learn more.

“Based on current information, the compromised data is in digital form and may include certain historical personal health information maintained in our electronic medical record system.”

The clinic, at 43A Marion St., said it has notified the ombudsman’s office and would report it to the College of Physicians and Surgeons of Manitoba.

“Our priority is to identify any affected individuals and confirm what data may have been accessed so that we can provide accurate updates.”

The letter tells patients if they have questions they can contact either the medical centre or the ombudsman’s office.

Clinic administrator Dr. Ghulam Memon did not return requests for comment.

RCMP said they are looking into the matter and couldn’t comment until later this week.

“Personal data is a hot commodity for all kinds of reasons… and none of it is very good.”

A patient of the clinic, who asked not to be named, said, like many others, she has previously been the victim of hacking, but this time she felt “violated” when she read the letter.

“This is on a different level for me,” she said. “This is my doctor. I care a lot about my health, and I tell my doctor everything. What are they going to do with this information?

“What am I supposed to do with this now?”

In Manitoba, all trustees of health information have to report breaches of privacy to the ombudsman.

This includes doctors, dentists, pharmacists, hospitals, personal care homes, provincial government departments, school divisions and post-secondary institutions.

“Personal health information is some of our most sensitive and private information,” ombudsman Jill Perron said.

“We trust that entities will treat our health information with confidentiality and that they will exercise care and due diligence to take measures to protect and safeguard it. When a privacy breach occurs, notifying affected individuals and reporting to our office can demonstrate accountability and help restore trust.”

Vanessa Iafolla, principal at the Halifax-based Anti-Fraud Intelligence Consulting, said the breach shows that no data is fully secured in an increasingly digital world.

“It is almost a certainty at some point you will be involved in something that is compromised.”

“Digital access means it is not stored in a locked filing cabinet in an office where the reach is much more limited by actors,” Iafolla said. “Personal data is a hot commodity for all kinds of reasons — and none of it is very good.”

Iafolla said a breach like this has become a sign of the times.

“It is almost a certainty at some point you will be involved in something that is compromised,” Iafolla said. “You’re stuck for the rest of your life wondering if the shoe will drop.

“We’re just in the position of just have to accept that increasingly this will be the norm and we just have to cope with the fallout as individuals.”

Keir Johnson, of Doctors Manitoba, said cyberattacks are not something the physician group often hears about.

“Privacy and cybersecurity are taken very seriously by physicians,” he said.

kevin.rollason@freepress.mb.ca