A Toronto hospital network has reported that the personal information of about 150 patients has been affected by a data breachat a third-party provider, with patients' medical records being used in a blackmail attempt.
Unity Health Torontosaid the incident was caused by a former employee of Nuance Communications, a company that transcribes clinical notes dictated by doctors at St. Michael’s.
The hospital network announced that it discovered the breach in May, but only notified patients last week.
“We are taking this matter seriously and have notified all affected patients,” Unity Health Toronto said in a statement. “We apologize for any inconvenience this may have caused to the approximately 150 patients affected.”
The Nuance Communications employee allegedly kept patient records after he was removed from the company, Unity Health said.
In March, that person allegedly attempted to use the files to blackmail Nuance for money, the health network said.
The records the employee kept included patient names, medical histories, diagnoses and treatments, according to the network, but did not include financial or insurance information.
Nuance reported the matter to police in India, where the alleged incident is believed to have occurred, Unity Health said. Officers were able to locate a computer believed to contain patient information, the network said.
A court order was also issued to prevent the former employee from further accessing or sharing any information from patient reports, the health network said.
Unity Health added that Nuance Communications said it had taken steps to improve its information security practices. St. Michael's Hospital said it had conducted its own investigation and had reported the issue to the Privacy Commissioner of Ontario. It also said it was working with Nuance Communications to address the issue.
