LifeLabs Data Breach: The Shocking Cyberattack That Should Wake up Every Healthcare Provider in Canada

From the ‘Office of the Saskatchewan Information & Privacy Commissioner

(INVESTIGATION REPORT 398-2019, 399-3019, 417-2019, 005-2020, 019-2019, 021-2020)

“[8] When LifeLabs originally reported the breach to my office in December, it estimated that 93,390 Saskatchewan residents were effected. In its response to the breach that it provided to my office at the end of January, LifeLabs reported that 95,855 Saskatchewan residents were affected by the breach and were “mainly” from the patient wait time system. On March 3, 2020, my office asked for more details about the information that was affected outside of the patient wait time system. It responded that the information outside of the patient wait time system was collected to provide lab testing services for Saskatchewan residents either travelling through British Columbia or Ontario or for services purchased privately from LifeLabs. It indicated that 241 individuals from Saskatchewan were affected by the breach outside of the patient wait time system.

[9] On May 27, 2020, at the end of my investigation, LifeLabs requested that my office “consider the new granular facts relating to” the affected systems. It had not previously provided information about these systems in a Saskatchewan context.

[10] LifeLabs indicated that the personal health information of 93,390 Saskatchewan residents affected by the cyberattack were related to its patient wait time system. The patient wait time system refers to the system where individuals can book appointments online. The data elements involved include name, email address, password and security questions and answers. Four months after providing its initial response to my office, LifeLabs indicated that telephone numbers, Internet Protocol addresses (IP addresses) and various information about login attempts were also affected by the breach. Prior to this, LifeLabs did not report all of the data elements in a clear manner in its response to my office.

[11] Additionally, LifeLabs initially indicated that the cyberattack also resulted in the unauthorized disclosure of names, sex, phone numbers, addresses, email addresses, birth dates, user identifications, passwords, security questions and answers, health card numbers, and results of laboratory testing of 241 Saskatchewan residents. As noted, LifeLabs reported that these individuals received services while in British Columbia or Ontario or received private services from LifeLabs.

[12] After May 27, 2020, LifeLabs again provided more specific information about data elements and systems affected. It indicated that one of the affected systems that related to services performed in Ontario contained no test orders or results for Saskatchewan residents. However, at this late stage in my investigation, LifeLabs reported that the demographic information of 15 Saskatchewan residents in this system was affected by the breach. This includes name, date of birth, “patient sex”, address and health card number. It did not provide specific information as to why it collected only demographic information of the 15 Saskatchewan residents in this system.

[13] On May 27, 2020, LifeLabs also noted that the information of 242 Saskatchewan residents that was stored in a system related to services provided in British Columbia was also affected by the breach. Data elements involved included name, date of birth, “patient sex”, address, telephone number, health provider name and health card number.

[14] The affected individuals used LifeLabs’ patient wait time system to arrange an appointment with LifeLabs so that LifeLabs could provide a health care service on behalf of the SHA. This included name, email address, telephone numbers, passwords and security questions and answers. This qualifies as registration information pursuant to subsection 2(q) of HIPA as they were collected for the purpose of registering individuals for the provision of health services. Further in Review Report 186-2019, Review Report LA-2013-003, my office has indicated that IP addresses can be considered personal information if it can be associated with an identifiable individual. In this case, it appears that the IP addresses and various other login information from the patient wait time system that was affected by the breach can also be considered registration information as it is part of the information collected by LifeLabs to register these affected individuals for health services that they provided on behalf of the SHA pursuant to subsection 2(q) of HIPA. [15] Similar data elements affected in the other systems, including names, email addresses, sex, telephone numbers, addresses, birthdates and health card numbers also qualify as registration information pursuant to 2(q) of HIPA. Therefore, these elements qualify as personal health information pursuant to subsection 2(m)(v) of HIPA.

[16] Lab results are information with respect to the physical health of an individual and information with respect to a health service provided to an individual. As such, it qualifies as personal health information pursuant to subsections 2(m)(i), (ii) and (iii) of HIPA. However, at the end of my investigation, LifeLabs indicated that the lab results affected in this breach did not relate to Saskatchewan residents, contrary to what had been reported to my office earlier.”