Timely Transparency Required at Health PEI Following Privacy Breach

An individual’s right to privacy, confidentiality, and protection of their personal information, in any setting where vulnerable information is shared, is of the utmost importance. Having this right infringed upon in respect to personal medical information, comes with an exceptional increase in distress and risk for harm. I am alarmed by today’s reported privacy breach at Health PEI affecting 4,000 Island patients, and 1,200 Health PEI long term care employees. My thoughts are with those who have been affected by this event and the justifiable frustrations and anxiety that comes with situations like these. You have every right to be concerned that your right to privacy was breached by an organization you put a considerable amount of trust in with some of your most sensitive information. The personal identifiers breached include name, date of birth, gender, health card numbers, and employment information of long term care staff. In addition, information regarding individuals emergency room visits has been breached, specifically, why an individual sought treatment at the emergency department and their subsequent diagnosis. This is sensitive Information holds the potential to be damaging to the individual involved in many ways. While modern information technology infrastructure has many benefits, concerns around personal information storage has never been higher. Hackers and those with malicious intent pose an increased risk to cyber security each day, even for the most advanced and secured networks. Although the risk of the information being accessed has been deemed low by Health PEI IT staff, this should serve as a wake-up call for Health PEI and their personal information privacy safeguards. I have many questions surrounding how this incident occurred in the first place. Where was the laptop stolen from? Why would the information accessible be from emergency room visits in September and October 2021 if the laptop was stolen in April 2022? Where on the computer was information stored and was it safeguarded appropriately? When were those affected notified? Islanders affected need more information than what was provided. Low risk is not zero risk, and Health PEI can not deem this event as case closed once the affected individuals are notified. The unfortunate truth is we may never know the future ramifications of events such as this. I call on Health PEI to expedite and provide a transparent public report on the findings of their internal review they state is being conducted. Including, identifying if any privacy policies were not adhered to, and the subsequent improvements made. Robert Henderson MLA, O'Leary - Inverness