In October 2023, Michael Garron Hospital (MGH) experienced a data security incident in which some of our data was exposed. In November 2023, we confirmed that the exposed data included personal information.
We previously reported that the personal information that was exposed belonged to current and some former employees and credentialed clinicians, learners, and volunteers. Between November 2023 and January 2024, we notified these affected people of the exposure of their personal information.
We also reported that our investigation into the exposure of patient and Michael Garron Hospital Foundation (MGHF) donor information was ongoing. This was to confirm what information was exposed. This investigation was complex and took time. The investigation is now complete, and we are able to provide an update regarding the exposed data.
This notice confirms that some personal health information of some patients at MGH, and some personal information of some MGHF donors was exposed in this data security incident. This includes the information outlined at the end of this notice. Please note that, at this time, we have no evidence that any personal information, including personal health information, was misused.
We take the protection of personal health information very seriously and will continue to be as open as possible. Patients whose personal health information was exposed have the right to file a complaint. Should you wish to do so, you can contact the Information and Privacy Commissioner of Ontario (IPC) via its website (ipc.on.ca/en/resources/information-individuals). While you are welcome to file a complaint with the IPC, it is not necessary to do so as the IPC is already investigating this matter.
We sincerely apologize for this incident and remain committed to protecting all personal information. In response, we have invested significantly in additional security measures to better protect our hospital network and information systems.
We wish to thank everyone who responded to this incident, including our healthcare teams, community partners, government agencies and law enforcement services. We also want to thank our patients, community members, staff, credentialed clinicians and donors for their patience and ongoing support.
If you have any questions about this incident, please visit our Frequently Asked Questions webpage. If you have any further questions, you can reach out to us at @email or call us at 1-888-339-0437.
MGH patients whose personal health information was exposed in the data security incident include:
Inpatients from January 2015 to October 2023:
The exposed information includes admission and discharge dates, dates of birth, diagnoses, health card numbers, mailing addresses, names, names of treating physicians, patient identification numbers, procedures received while at MGH, and sexes.
- Inpatients admitted from August 2021 to October 2023 and who were prescribed oral or topical medication: The exposed information also includes prescription information.
- Inpatients and dialysis patients that received parenteral medication compounded by MGH’s pharmacy between August 2018 and October 2023: The exposed information also includes prescription information.
Outpatients who attended one of MGH’s clinics in 2016, 2017, 2021, 2022, and from January to October 2023
The exposed information includes admission and discharge dates, dates of birth, health card numbers, the internal codes identifying the service which provided your treatment at MGH, mailing addresses, names, names of treating physicians, patient identification numbers, sexes, and telephone numbers.
MGHF donors
For certain MGHF donors, the exposed information includes addresses, ages/dates of birth, dates of death, donation dates, types, and/or amounts, education information, email addresses, ethnicity information, estimated donation ability, expiry dates of payment card, financial account information, gender, marital status, names, phone numbers.