Ontario’s privacy commissioner is still looking into a data breach involving hospitals in the Waterloo region, which they were alerted about around six months ago.
The Waterloo Regional Health Network (WRHN), responsible for hospitals in Kitchener, informed patients in March that there had been a data breach affecting the network’s connection to a third-party system used to share patient care information with primary health care providers.
This system is managed by Ontario Health. WRHN states that the data breach didn’t impact its internal systems and was contained as of January 13.
The Information and Privacy Commissioner (IPC) of Ontario received notice about the breach on February 9.
Now, six months later, when someone calls the privacy commissioner’s main line, there’s an automated message waiting for them.
“If you have been affected by the privacy breach at the Waterloo Regional Health Network, there is no need to file a complaint with our office as our investigation is already underway,” part of the message states.
“We recognize that this is a stressful time and appreciate your patience while we conduct our investigation.”
The IPC encourages anyone with further questions to reach out directly to WRHN using an email and phone number set up specifically for inquiries related to the privacy breach.
WRHN has previously confirmed that the data breach was contained within hours of being discovered and did not affect clinical records or patient care.
However, they also mentioned that it can’t be ruled out that personal health information may have been compromised.
According to WRHN, information potentially exposed could relate to clinical details about 150,000 individuals’ care from April 2025 through January 2026.
No updates since March: WRHN
If someone calls WRHN’s dedicated phone line regarding the privacy incident, they’ll hear another recorded message stating in part, “We are receiving a significant volume of messages and.. as a reminder, our systems remain secure and the risk to personal health information is believed to be low.”
The recorded message from WRHN asks callers to leave their name and contact details briefly.
reached out asking if any updates have emerged since the breach was reported six months ago or when more information might be available about what transpired.
In response, WRHN stated there haven’t been any new updates since their letter released in March...{“The risk continues”}{“to remain low.”}{“WRHN continues”}{“to notify potentially affected patients out of an abundance of caution,”}{“though no action”}{“is required from patients,”}{“the health network said.”}
.
