eHealth Saskatchewan, the Saskatchewan Health Authority, and the Saskatchewan Ministry of Health say an eHealth malware attack last January may have resulted in a privacy breach of personal health information. A months-long forensic investigation resulted from the breach.
While there is no evidence that personal health information was compromised, the investigation was unable to rule out a breach.
eHealth Saskatchewan managed to contain and eliminate the malware and restore compromised files.
The conclusion of a likely privacy breach follows findings in the forensic investigation that some files were sent to a suspicious IP address. Those files had been encrypted during the attack, and were restored from back-ups.
eHS continues to monitor and scan the internet for any signs that Saskatchewan files have found their way into improper hands. The latest six-week scan was completed in November and to date there continues to be no evidence to show this has happened.
Since the malware attack, eHS, SHA and Ministry of Health have intensified training for employees on the dangers of opening email with suspicious attachments. eHealth says it is also continuously making security upgrades to its IT network to strengthen the security environment.
All active SHA staff are required to take mandatory privacy training every three years or as directed. The SHA also has standard privacy and confidentiality policies, including requirements for staff to sign confidentiality agreements to help protect personal health information.
eHS has also recently procured a new program for providing IT security education to health system physicians and staff that it says will strengthen knowledge among health care workers about the steps they can take to better protect personal health information from malicious cyber-attacks.
If you do suspect a breach of your personal health information, you can contact SHA’s Privacy Office at privacy@saskhealthauthority.ca.
Anyone with a concern about privacy and protection of their personal health information can contact the Office of the Information and Privacy Commissioner:
• Toll-free (in Saskatchewan) 1-877-748-2298
• Email: webmaster@oipc.sk.ca
