PharmaNet breach compromises personal information of 7,500 B.C. residents, says province

The personal information of approximately 7,500 British Columbiansmay have been compromised through the provincial government's PharmaNet system, according to the Ministry of Health.

A letter from the ministry was sent last week to B.C residentsaffected by the breach. The lettersaysan "unknown/unauthorized person obtained and used a physician's login to access PharmaNet."

PharmaNet is the province-wide network that links all B.C.pharmacies to a central information system.

According to the letter, obtained by CBC News, personal information such as individualnames, addresses,dates of births, andCare Card numbershave been viewed.

Investigation underway

The government confirmed the accuracy of the letter Wednesday evening, and said an investigation affecting 14 physicians is underway.

They also said that of the approximately 7,500 individuals who had their profiles viewed, 80 also had their medication history over the past 14 monthsviewed.

"The Ministry of Health has begun to send letters to all patients and doctors affected by the breach, notifying them of the incident and advising them of precautionary steps they can take to protect themselves from identify theft," wrote the ministry in a statement.

"Health Ministry staff are also working with the affected physicians and their offices and Pharmanetsystem vendors to identify security measures that should be put in place to provide increased protection, such as regularly changing passwords and using a secure internet provider."

There are four individual incidents,all of which have taken place since the fall of 2016, being investigated by the Ministry of Health and the Corporate Information and Records Management Office of the Ministry of Finance.

The ministry said it did not know how the breach occurred.

Not the first PharmaNet breach

This isn't the first timePharmaNetfiles have been breachedunknowingly. Between March 9 and June 19 2014,about 1,600 patients had their private data in the prescription system accessed by an unknown hacker.

• B.C. PharmaNet hit by hacker, 1,600 accounts breached
• 'Serious deficencies' blamed for 3 B.C. health data breaches
• Less than half of B.C. doctors thoroughly check patients' prescription history, says researcher

In that case, ministry officials said the unauthorized person used a doctor's account, of which the doctor wasn't aware.

The repeated breaches alarmedone Opposition MLA, who accused the government of failing to protect the privacy of British Columbians.

"It always concerns me when I see a breach, but what concerns me more is when I see repeated examples of the same sorts of breaches and the same sorts of problems and repeated assurances that they'll never happen again,"said MLA DougRoutley, NDPcritic for Freedom on Information and Privacy Protection.

"Governmentmust protect your personal information, they're failing to do that."

'Starting point' for identify theft, says ministry

The ministry of healthletter to patients, dated Feb.6, 2017, states there is "no other private information, such as banking, attached to your record,"but says "the information gathered could possibly be used as a starting point for identity theft."

"We encourage you to take precautions to safeguard your other personal information," it says and suggeststhose affectedmay want to seek out the services of a credit monitoring company.

The Ministry of Health says it has begun sending letters to all patients and doctors affected by the breach, and is working withaffected physiciansto identify security measures that should be put in place to provide more protection.

In addition, various medical groups have been notified includingDoctors of BC,the College of Physicians and Surgeons BC, the Canadian Medical Association and the Office of the Information and Privacy Commissioner.

"Government and all of our agencies take the protection of personal information of patients very seriously," the ministry wrote.

"We're doing everything we can to identify the source of the problem and make the necessary improvements to ensure that breaches like this do not occur in the future."

With files from Justin McElroy and Richard Zussman