Investigation Continues into Data Breach at Waterloo Hospitals

Ontario’s privacy commissioner is still looking into a data breach involving hospitals in the Waterloo region, which they were alerted about around six months ago.

The Waterloo Regional Health Network (WRHN), responsible for hospitals in Kitchener, informed patients in March that there had been a data breach affecting the network’s connection to a third-party system used to share patient care information with primary health care providers.

This system is managed by Ontario Health. WRHN states that the data breach didn’t impact its internal systems and was contained as of January 13.

The Information and Privacy Commissioner (IPC) of Ontario received notice about the breach on February 9.

Now, six months later, when someone calls the privacy commissioner’s main line, there’s an automated message waiting for them.

“If you have been affected by the privacy breach at the Waterloo Regional Health Network, there is no need to file a complaint with our office as our investigation is already underway,” part of the message states.

“We recognize that this is a stressful time and appreciate your patience while we conduct our investigation.”

The IPC encourages anyone with further questions to reach out directly to WRHN using an email and phone number set up specifically for inquiries related to the privacy breach.

WRHN has previously confirmed that the data breach was contained within hours of being discovered and did not affect clinical records or patient care.

However, they also mentioned that it can’t be ruled out that personal health information may have been compromised.

According to WRHN, information potentially exposed could relate to clinical details about 150,000 individuals’ care from April 2025 through January 2026.

No updates since March: WRHN

If someone calls WRHN’s dedicated phone line regarding the privacy incident, they’ll hear another recorded message stating in part, “We are receiving a significant volume of messages and.. as a reminder, our systems remain secure and the risk to personal health information is believed to be low.”

The recorded message from WRHN asks callers to leave their name and contact details briefly.

reached out asking if any updates have emerged since the breach was reported six months ago or when more information might be available about what transpired.

In response, WRHN stated there haven’t been any new updates since their letter released in March...{“The risk continues”}{“to remain low.”}{“WRHN continues”}{“to notify potentially affected patients out of an abundance of caution,”}{“though no action”}{“is required from patients,”}{“the health network said.”}

.

No updates during ongoing investigation: IPC office</h2}

{1}. “{3}”}

The asked if there have been any developments in their investigation or why there’s a recorded message for callers concerning WRHN’s data breach.
The privacy commissioner’s office sent back a brief statement confirming they currently don’t have new details available.
“As we are currently investigating this matter, we cannot provide additional details at this time. However, we would be happy to inform you of the outcome once the matter is resolved,” part of their statement reads.
There was no indication given regarding how many calls they’ve received.
“If someone feels that their personal health information has been impacted by this incident they can file a complaint with our office, though it is not necessary as we are already looking into the matter.”

Source link