Markets 
Senior staff in the Minister of Health’s office were notified about a cyber attack at a government home care agency more than a month before the public was told, despite publicly scolding the organization for not moving faster.
Last June, an Ontario Liberal MPP raised the alarm about a cyber attack suffered by one of Ontario Health atHome’s key vendors months earlier, prompting the government to direct the arms-length organization to take action.
“Our government expects all service providers to uphold the highest standards of patient care, security and confidence,” the Ministry of Health wrote in a statement three months after Ontario Medical Supply suffered a ransomware attack.
“This includes taking immediate steps to identify when there has been a cyber breach and to notify the Ministry of Health immediately. The fact that this process was not followed is unacceptable.”
New documents obtained by Global News, however, suggest the agency told senior political staff about the breach within days of confirmation that patient data had been impacted.
Get weekly health news
Receive the latest medical news and health information delivered to you every Sunday.
The initial ransomware software infiltrated vendor Ontario Medical Supply’s systems in mid-March and the “payload” was delivered on April 13, according to records from Ontario Health atHome.
The next day, Ontario Medical Supply told Ontario Health atHome it was suffering a system outage. It wasn’t until May 21 that the vendor was able to confirm patient data had been impacted.
Now, new records obtained by Global News suggest that information was quickly passed to political staff and civil servants at the Ministry of Health.
A calendar invitation was sent to six senior staff in Health Minister Sylvia Jones’ office on May 23. The meeting was to provide a “briefing on any impacts and next steps following the Ontario Medical Supply (OMS) system outage.”
The meeting, which appears to have taken place on May 30, was sent to Jones’ chief of staff as well as the deputy minister, the most senior civil servant in the Ministry of Health.
“It’s astonishing to think that they were aware personal health information for hundreds of thousands of Ontario patients may have been compromised and they sat on that,” Ontario Liberal MPP Adil Shamji told Global News.
“A government cannot lead, they cannot earn trust, they cannot solve problems if it is constantly running from the truth. The minister of health, Sylvia Jones, has always insisted she acted as soon as she knew. We now have incontrovertible evidence that the Ministry of Health actually did know.”
The Ministry of Health did not directly answer questions from Global News over why it did not move to immediately inform patients about the data breach.
Instead, a spokesperson sent a statement outlining the order of events.
“Ontario Health at Home (OHaH), once notified by OMS, a third-party medical supplies provider of the cybersecurity attack, alerted the Information and Privacy Commissioner (IPC) and diligently followed the IPC’s advice in the process of informing those whose health information had been breached,” they wrote.
Documents previously obtained by Global News confirmed the cyber attack was ransomware and suggested that a ransom was paid to the hackers.
“This is an agency that has been plagued with problems almost from the moment of its conception,” Shamji added. “There have been massive challenges in home care, and that’s putting it lightly.”
Read the full article here
