Information and privacy commissioner investigating after eHealth cyberattack

Saskatchewan’s Information and Privacy Commissioner has started an investigation into a cyberattack that targeted the company that handles health records in the province.

On Jan. 5, eHealth Saskatchewan was hit with ransomware, a type of software virus that locks users out of their own data. The hackers then demand payment from the victim to restore access to the files.

In a statement Thursday, eHealth says it has isolated the malware and has found “no evidence that confidential patient information has been compromised.”

eHealth says it has brought in a team from Microsoft to restore the applications that eHealth had shut down as a precaution.

“eHealth would like to thank all those impacted for their continued patience and co-operation as work continues to restore full administrative functions within the health system,” the statement added.

In a media release about the investigation, the province’s privacy commissioner, Ronald Kruzeniski, said his office is working closely with eHealth.

“The IPC investigation will, among other things, examine whether there was a breach of personal information or personal health information, and if so, the scope of the breach, the circumstances leading to it, and what, if any, measures eHealth could have taken to prevent and contain the breach,” Kruzeniski said.

“My office will also investigate ways eHealth can help ensure the future security of personal health information and avoid further attacks.”