Notice to Patients of Cybersecurity Incident

August 30, 2023

 

Dear CCH Community,

We are writing to provide you with an update regarding the cyber incident CCH identified on April 11, 2023 (the “Incident”). We take the privacy and security of personal information very seriously, and sincerely regret that this Incident occurred. As soon as the Incident was identified, CCH immediately retained leading third-party cybersecurity experts to conduct a detailed investigation, and to assist in containing the Incident and restoring the security of our systems. While the investigation is nearing completion, we are continuing to closely monitor the situation and have not detected any malicious use of data. Importantly, CCH’s Electronic Health Record System was not impacted by the Incident.

We understand that a situation like this may create stress and anxiety about the safety of your personal information. Accordingly, we want you to know a few important things.

 

What Happened

  • On April 11, 2023, CCH’s IT personnel identified a network issue with its systems. After preliminary investigation with the help of leading third-party cybersecurity experts, the network issue was determined to be a result of a cyber incident. Once this determination was made, CCH took immediate steps to contain the Incident and investigate further.
  • With the help of our third-party cybersecurity experts, further analysis determined that CCH’s Electronic Health Record System was not impacted by the Incident.
  • Unfortunately, however, many of CCH’s files including copies of patient records became corrupted and several systems were left inoperable (collectively, the “Corrupted Records”) as a result of the Incident.
How you might be Impacted
  • The investigation identified that these Corrupted Records may have contained some elements of patient data.
    • A. If you were a patient at CCH between 1950 and April 11, 2023:
      • A copy of your registration records containing the following categories of personal health information was corrupted as a result of the Incident:
        • Health card number; and
        • Demographic information (such as: date of birth, gender, home address).
      • Despite the corruption of the above-noted categories of personal health information, please note that the original form of this information remains intact within our Electronic Health Record.
    • B. If you were a patient at CCH between May 8, 2020 and April 11, 2023:
      • A copy of your records containing the following categories of personal health information has been corrupted as a result of the Incident:
        • Health card number;
        • Demographic information (such as: date of birth, gender, home address);
        • Discharge summaries (such as: admission and discharge date, condition upon discharge, and diagnostic results);
        • Consultation notes and medical results (such as: reason for referral, name of referring physicians, medical and family history, exam/lab results); and
        • Dietary and pharmacy-related information (such as: health card number, list of allergies, and name of clinician placing order).
      • Despite the corruption of the above-noted categories of personal health information, please note that the original form of this information remains intact in our Electronic Health Record.
    • C. If you were a client of one of CCH’s Addiction and Mental Health Community Programs between 2003 and April 11, 2023:
      • The following categories of personal health information may have been subject to unauthorized access as a result of the Incident:
        • Health card number;
        • Medical/psychosocial histories, assessments and case notes;
        • Medications.
      • Despite the corruption of this information, if your visit was prior to 2017, the original form of this information remains intact in the Electronic Health Record.
      • If your visit was between 2017 and April 11, 2023, your records have been corrupted/destroyed and are unfortunately not accessible as a result of the Incident.
  • To date, while the categories of information noted above may have been subject to unauthorized access and destruction, there is no indication of any malicious use of personal health information.

What We Are Doing 

  • CCH took multiple steps to contain and remediate the Incident:
    • Upon learning of the Incident, we immediately sought to contain it by severing access to the Internet and all third-party networks, while maintaining our highest possible standards of patient care.
    • We engaged leading third-party cybersecurity experts to conduct a detailed investigation into what happened and worked around the clock to remediate the Incident.
    • Our IT team further strengthened security controls and maintained constant monitoring across the CCH environment to limit the risk of this kind of incident happening again.
    • In compliance with provincial health legislation, the Information and Privacy Commissioner of Ontario (“IPC”) has also been notified.
What You Can Do

Although there is no indication that any information involved in the Incident has been misused, we would like to remind you to be diligent, as always, when protecting your identity by monitoring your accounts and remaining vigilant for incidents of fraud and identity theft.

If you would like to get in touch with ServiceOntario regarding your health card number, you can visit any of ServiceOntario’s centres, their website, or call them (toll-free in Canada) at 1-800-267-8097.

As we noted above, the IPC has been notified of the Incident. To file a complaint, please visit: https://www.ipc.on.ca/resources/forms/.

CCH will not contact you by email requesting you to provide or verify sensitive personal information. When in doubt or if you have any concerns about the validity of any emails CCH sends, please contact us as indicated below. 

If you inquired about Community Addiction and Mental Health services prior to April 11th, believe you were placed on a waitlist and have not heard from us, please call 613-938-4240 ext. 8764 to confirm with our staff. 

 

For More Information

Again, we regret that this Incident occurred and apologize for any inconvenience it has caused.

If you have any questions regarding this Incident or if you desire further information or assistance, please contact our Communications Office at 613-938-4240 ext. 2722 or cch.communications@cornwallhospital.ca.

Should there be any further information about this Incident and your personal information, we will provide updates on this webpage.

 

Click here for Frequently Asked Questions.