N.E. Calgary medical clinic information breach blamed on out-of-date computer

CALGARY – The Office of the Information and Privacy Commissioner is warning all Alberta organizations to keep their computers up-to-date to avoid being infiltrated by hackers.

In January, the University of Calgary’s medical clinic in Sunridge was infected by nine Trojan horse programs which allow hackers to take control and steal data from the affected computers.

The infected server contained patient information, personal health numbers and health insurance billing codes. No financial records or credit card information was stolen.

Around 5000 patients impacted by the breach were informed.

An investigation by Health Information Act Director Brian Hamilton found the breach was caused by an unmanaged computer server that was not included in regular security scans.

The server’s operating system and anti-virus software was out of date.

The report has made several recommendations to prevent security breaches in the future, including conducting an annual review of their information systems, conducting risk assessments before installing new equipment or software and providing annual security training to all staff.

“It only takes one neglected computer to make your entire infrastructure vulnerable,” said Information and Privacy Commissioner Frank Work.

The University of Calgary says it is implementing the recommendations made in the report.