A joint investigation by the information and privacy commissioners (IPC) of Ontario and B.C. has found that LifeLabs failed to protect the personal health information of millions of Canadians, resulting in a significant privacy breach in 2019.
The joint investigation revealed that the company’s failure to implement reasonable safeguards to protect the personal health information of millions of Canadians violated Ontario’s health privacy law, the Personal Health Information Protection Act (PHIPA), and B.C.’s personal information protection law.
The Ontario and B.C. offices determined the company:
- failed to take reasonable steps to protect the personal health information in its electronic systems;
- failed to have adequate information technology security policies in place; and
- collected more personal health information than was reasonably necessary.
Both offices have ordered LifeLabs to implement a number of measures (summarized in the accompanying backgrounder, below) to address these shortcomings.
Publication of the report is being held up by LifeLabs’ claims that information it provided to the commissioners is privileged or otherwise confidential. The commissioners reject these claims. The Ontario IPC and B.C. OIPC intend to publish the report publicly, unless Lifelabs takes court action.
Michael McEvoy, information and privacy commissioner of British Columbia, said: “LifeLabs’ failure to properly protect the personal health information of British Columbians and Canadians is unacceptable. LifeLabs exposed British Columbians, along with millions of other Canadians, to potential identity theft, financial loss, and reputational harm. The orders made are aimed at making sure this doesn’t happen again.
“This investigation also reinforces the need for changes to B.C.’s laws that allow regulators to consider imposing financial penalties on companies that violate people’s privacy rights. This is the very kind of case where my office would have considered levying penalties.”
On March 25, 2020, the Ontario government amended Ontario’s health privacy law. Once implemented, Ontario will be the first province in Canada to give the information and privacy commissioner the power to levy monetary penalties against individuals and companies that contravene PHIPA.
- Statement from the Office of the Information and Privacy Commissioner of Ontario and the Office of the Information and Privacy Commissioner for British Columbia on LifeLabs privacy breach: https://www.ipc.on.ca/newsrelease/statement-from-the-office-of-the-information-and-privacy-commissioner-of-ontario-and-the-office-of-the-information-and-privacy-commissioner-for-british-columbia-on-lifelabs-privacy-breach
Information about LifeLabs, privacy breach, findings
- LifeLabs is Canada’s largest provider of general health diagnostic and specialty laboratory testing services. It has been in operation for over 50 years and has 5,700 employees. It provides a full range of outpatient laboratory services and other testing services, including genetics and naturopathic testing.
- LifeLabs performs over 100 million laboratory tests each year, with 20 million annual patient visits to its locations. Its website hosts Canada’s largest online patient portal, on which more than 2.5 million individuals access their laboratory results each year.
- On Nov. 1 and 5, 2019, LifeLabs notified the Office of the Information and Privacy Commissioner of Ontario and the Office of the Information and Privacy Commissioner for British Columbia of a potential privacy breach under Ontario’s Personal Health Information Protection Act and British Columbia’s Personal Information Protection Act.
- LifeLabs advised that on Oct. 28, 2019, it detected a cyberattack on its computer systems. On Dec. 17, 2019, the Ontario and B.C. privacy commissioners announced their joint investigation into the breach, which affected millions of Canadians.
- The Ontario IPC and B.C. OIPC have not published their investigation report because LifeLabs has claimed that some of the information contained in the report is privileged or confidential and objected to the release of that information.
- The Ontario IPC and B.C. IPC have made a finding that LifeLabs has not proven these claims and they intend to issue the report publicly unless LifeLabs decides to try to get a court ruling that the information is privileged or confidential.
Some of the findings made by the commissioners in the investigation of the LifeLabs breach were (note that in the following, some of the findings and orders are paraphrased and details omitted for confidentiality reasons):
- LifeLabs failed to take reasonable steps to safeguard personal information and personal health information.
- LifeLabs did not have adequate information technology security policies and information practices in place.
- In a specific instance, LifeLabs collected more information than necessary.
- LifeLabs took reasonable steps to contain and investigate the breach.
- Since the breach, LifeLabs has for the most part taken reasonable steps to address the shortcomings in its information technology security measures. However, additional steps are required as reflected in the orders below.
The Ontario IPC made the following additional findings in this investigation:
- While LifeLabs has largely taken adequate steps to notify affected individuals of the breach, its process for notifying individuals of which specific elements of their own health information were compromised was inadequate.
- The terms under which LifeLabs provides laboratory services to other health information custodians require clarification.
Given these findings, the commissioners issued the following orders to LifeLabs:
- LifeLabs is ordered to improve specific practices regarding information technology security.
- LifeLabs is ordered to formally put in place written information practices and policies with respect to information technology security.
- LifeLabs is ordered to cease collecting specified information and to securely dispose of the records of that information which it has collected.
The Ontario IPC issued the following additional orders:
- LifeLabs is ordered to improve its process for notifying individuals of the specific elements of their personal health information that were the subject of the breach.
- LifeLabs is ordered to clarify and formalize its status with respect to health information custodians in Ontario with whom it has contracts to provide laboratory services.
In addition, the commissioners recommended that:
- LifeLabs consult with independent third-party experts with respect to whether a longer period of credit monitoring service would be more appropriate in the circumstances of this breach.