October [ 16 ], 2020
To our valued patients of the Eastgate Medical Clinic,

We are writing to share with you information regarding a data security incident that involved your personal health information. We take this incident very seriously. While we have no information to suggest that any health information was accessed or disclosed, we are providing this notification to you out of an abundance of caution and in accordance with our obligations as custodians as defined in the Health Information Act.

On September 6, 2020, the Eastgate Medical Clinic (the “Clinic”) experienced a ransomware attack, which resulted in the encryption of image files within the Clinic’s database. In response, we immediately retained an IT firm to conduct a thorough investigation into the circumstances surrounding the incident. Based upon our investigation, it appears that an unauthorized individual encrypted certain files containing personal health information, which were held in a database external to the Clinic’s electronic medical record. This database contained image files of faxed records including: patient questionnaires with personal information (e.g. names, addresses, telephone numbers, personal health numbers), radiology reports, lab/other test results and consultation letters (the “Records”). Based on the investigation by the IT firm, there is no evidence to suggest that the personal information within the Records were accessed and/or disclosed as a result of the cyber incident. The IT firm has advised that typically, ransomware simply encrypts data, in essence holding it hostage until the requested ransom is paid, at which time a decryption key is provided, allowing data to be restored to its usable form. This is what we understand to have occurred here. The Records were encrypted until the Clinic paid the ransom amount, at which time a decryption key was provided and the data was restored on September 26, 2020.