Health P.E.I. has notified the public that personal health information for some Islanders may have been accessed after a cybersecurity incident at a third‑party service provider.
What happened
The provincial health authority said Monday an "unauthorised person" obtained a copy of a file that was created in 2011. The file was held by a company that provides services to Health P.E.I., and the breach occurred within that company, not directly on Health P.E.I.'s own systems, the authority said.
Who may be affected
Health P.E.I. identified two groups that may be impacted:
- People who had a P.E.I. health card number in or before 2011.
- Non‑residents who received health services in Prince Edward Island between 2008 and 2011.
According to the health authority, the file in question included some or all of the following data elements:
| Data element | Possible presence in file |
|---|---|
| First name | Yes |
| Last name | Yes |
| Date of birth | Yes |
| Date of death | Yes |
| Gender | Yes |
| P.E.I. personal health number | Yes |
| Medicare eligibility information | Yes |
Health P.E.I.'s assessment
In its release, the authority said it believes the likelihood the information will be misused is low.
"Based on the information available today, we believe the risk that this information will be misused is low,"the statement quoted Laurae Kloschinsky, interim CEO of Health P.E.I.
The release said the notice to the public is being made to be transparent and to ensure potentially affected individuals are aware of the incident. Health P.E.I. emphasised it takes the protection of personal health information seriously.
What this means for Islanders
The incident is limited to a file created in 2011 that was held by a vendor. That means recent registrants or people who obtained a P.E.I. health card after 2011 are not listed among the groups identified as possibly affected. However, anyone who had a health card number in that timeframe or who sought care here as a non‑resident between 2008 and 2011 should be aware of the notice.
People concerned about their information can expect Health P.E.I. to provide further details and direction as the authority completes its review. At this stage, the public notice is intended to inform and reassure Islanders that the matter is being handled.
Practical steps and context
Health‑record breaches at vendors are an increasing focus for organisations that hold sensitive information. Even where the assessed risk is low, transparency and timely notification help people understand potential exposure and take steps if necessary.
- Watch for further notices from Health P.E.I. about steps to confirm whether you are affected.
- Check any communications carefully to ensure they are legitimate and from the health authority before sharing personal details.
- Monitor your personal accounts and official documents for unexpected activity and report any concerns to the relevant authorities.
Health P.E.I. did not provide additional technical details in the initial release about how the vendor incident occurred, which third‑party company was involved, or whether law enforcement or privacy regulators have been notified. The authority said it is continuing to work with partners as it reviews the matter.
Local impact
For Islanders who rely on public health services and who keep long histories with the provincial system, the notice is a reminder that records created years ago can still exist in vendor systems. Older files may contain data elements that remain sensitive, such as date of birth and personal health numbers.
As Health P.E.I. completes its review, residents can expect follow‑up communication if they are identified as potentially affected. The authority's public statement was aimed at ensuring transparency and at giving Islanders early warning while investigations continue.
This story will be updated as Health P.E.I. releases more information.
