Hackers have stolen the personal health information of an unknown number of patients following what the Barrie Community Family Health Team (BCFHT) are calling a “cyber-security incident” that occurred this spring.
Patients were informed of this news via a letter dated Aug. 27, which was obtained by BarrieToday, from executive director Kim Vickers.
The letter says the BCFHC learned of the incident on March 6.
“The Barrie Community Family Health Team takes the security of personal information and personal health information in our care very seriously,” Vickers wrote in the letter.
BarrieToday was unable to reach BCFHT officials for further comment.
In the letter, Vickers explains it was being sent to inform impacted patients of the incident and the steps being taken to “bolster the protection of personal health information,” as well as advice on additional steps they can take to ensure the security of their personal information.
“On March 6, 2024, we discovered that an unauthorized third party gained access to a portion of our network environment and temporarily rendered some systems inaccessible," she wrote. "We responded immediately and took steps to contain and isolate the threat and deployed countermeasures to prevent against further unauthorized access to our network.”
Vickers noted the BFCHT also retained third-party cyber-security experts to assist with containment, remediation and to conduct a forensic investigation in order to determine the nature and the scope of the incident.
“On April 11, 2024, our cyber-security experts determined that the unauthorized third party accessed and exfiltrated certain data pertaining to a very small subset of our patients from our system," she added.
The local health-care provider then conducted what Vickers said was a “thorough and robust review” of the data involved in order to identify patients who may have been impacted, as well as to determine the type of personal information and personal health information that was involved.
That investigation, she said, took “several months” to complete, during which time the BCFHT has been working with the third-party experts to notify those who were affected as quickly as possible.
The information stolen may have included a patient’s name, date of birth, phone number, address, health card information, sex, gender, physician’s name, patient status, medical notes and treatment information, the letter stated.
“Since discovering this incident, we have consulted with cyber-security experts about ways to better prevent against an incident of this nature from occurring again, and have further improved our existing security measures," Vickers added.
The security breach has been reported to the Information and Privacy Commissioner of Ontario, states the letter, adding patients whose information was compromised are also free to file a complaint.
“We apologize for any inconvenience or concern this incident may cause you,” said Vickers.
Anyone with concerns or questions is invited to contact the BCFHT’s dedicated incident response line at 1-833-947-4021.
