I’m Kate Dewhirst.

I’m a lawyer who writes about legal issues affecting healthcare in Canada

Kate Dewhirst Health Law - bringing the law to life. Meet Kate (in 13 seconds)

Yikes! Want to know what a ransomware attack sounds like in healthcare?

Posted by

According to a CBC report published yesterday, a home medical services company was recently hacked and tens of thousands of health records for home care patients across Ontario were held for ransom.

The home care company issued a public statement in June 2018 confirming that it had been the victim of a cyber attack.

A group claiming responsibility has shared with the CBC copies of health records they collected through this cyber attack. The CBC  report says the sample they have seen includes “thousands of patient medical records with phone numbers and addresses, dates of birth, and health card numbers, as well as detailed medical histories including past conditions, diagnoses, surgical procedures, care plans and medications for patients across the province.”

To put it mildly … that’s not good.

We have heard about cyber attacks before in the health sector.  You may remember the stories of the WannaCry virus that attacked healthcare organizations around the world in May 2017.  The UK was especially hit hard – where they had to cancel surgeries and other medical appointments.  What you might not realize is that Ontario was also hit in that ransomware attack. An Ontario hospital was hit by the virus – which negatively affected their computer systems for weeks although they were able to ultimately keep the hackers out of their health records.

What does this new story of an Ontario ransomware attack mean for your health team?

It means a few things:

  1. Make sure you speak with your security team or consultants to ensure your health records are encrypted and protected against hacking.
  2. Train your team about how to identify a malicious email and not open it! More practical tips in my previous blog on the topic.
  3. Read the prevention tips against ransomware issued by the Information and Privacy Commissioner of Ontario and implement those activities for your team.

Good security practices and protocols require everyone’s attention.  Your security is only as good as your team members allow it to be.

This is a cautionary tale worth the attention of every Privacy Officer in health care.  <Shiver>


If you enjoyed this article please share it:


Previous and next posts from Kate:

Some of Kate’s recent and upcoming events

Team Privacy Training Events
February 12, 19, 26, 27, Mar 2, 9, 11, 24, 27

For Primary Care clinics, Hospitals, Community Agencies and Children’s Aid

Kate trains health professionals from many more health care organizations how being privacy-respectful can improve therapeutic relationships. More details...

Speaking event March 25, 2020

Osgoode Professional Development – Health Law Certificate

Kate joins the faculty for this training event. More details...

Primary care webinars: Employment Law Update & Legal Issues for EDs and Board members

Part of Kate’s monthly webinar series.

Our March webinar is on questions to ask your insurer and the April program is on changes to pregnant employees' positions.
Full details of the 2020 webinar series and registration here.

Health Privacy Officer training
April 28, 2020

For Privacy Officers within healthcare organisations.

This course focuses on how to become a more confident privacy officer and gives you the tools to document your privacy program. Full details and registration here...

Osgoode Health Privacy training
January 20 & 27 and February 3,10 & 18, 2020

Kate is the program chair for the Osgoode Certificate in Privacy in Healthcare.

This program explores the range of privacy interests that must be protected in the day-to-day treatment of patients, the development of information systems and the creation of institutional policies. More details...

Free healthcare privacy webinar - ask me anything!
March 4 (cancelled) but back April 1

Free webinars - advance registration needed

Whether you're an experienced privacy officer or new in the field, pick Kate’s brain for free for an hour, in this live webinar. No charge, but you’ll need to register in advance.

Kate Dewhirst Health Law

Kate says:

My mission is bringing the law to life. I make legal theory understandable, accessible and fun! I’m available and love to work for all organizations in the healthcare sector across Ontario and beyond.

Subscribe to my mailing list and keep up to date with news:

Latest Tweets

RT @riffcord: It's Family Day here in snowy Ontario. Wherever you are, use today to embrace the kites and anchors in your life. What are…

about 11 hours ago

Health Privacy Update: New class action certified in Ontario after privacy breach at a hospital… https://t.co/7KeAgBsoCi

about 20 hours ago

It’s not enough for health care organizations to respect patient privacy rights. I believe we have an obligation to… https://t.co/F19EYz0Uno

01:01 PM Feb 16th

contact details

901 King Street West Suite 400 East Tower
Toronto Ontario M5V 3H5

(416) 855 9557

.