QR codes are being temporarily removed from residents’ COVID-19 vaccination records due to a situation that eHealth Saskatchewan is treating as a privacy breach.
A Saskatchewan government release said they were alerted to an issue downloading patient QR codes.
“IT has identified that the COVID-19 vaccination records of up to 19 residents have the potential of displaying in other citizens’ QR codes. Information from one individual has been identified to date,” the release said.
eHealth Saskatchewan Vice President of Programs and Technology Davin Church told reporters on Friday that depending on what app the individual was using with the QR code, name and vaccination status would have shown up and perhaps date of birth and vaccination information.
He added that eHealth is aware of three instances of people receiving the individual’s information within their QR code.
Church said eHealth was made aware of this issue near the end of the day on Thursday.
“In an abundance of caution, QR codes will not be issued on vaccination certificates until early next week. Citizens are currently unable to view their proof of vaccination certificate in MySaskHealthRecord, although the vaccines administered still show,” the release added.
Church said eHealth knows what happened in this case, but is unable to share details publicly.
“(It is) security best practice to not disclose technical details of any nature or issue,” Church said.
“We have no indication that there’s any malicious activity. It was an issue within the solution that was identified,” Church confirmed.
“The vendor has reassured us that they have identified that issue, are working to resolve it and are doing substantial retesting over the next couple of days.”
Residents who have already printed, downloaded or captured the QR code on their COVID-19 vaccination record between Sept. 19 and Sept. 24 are asked to destroy or delete any records with the QR code as they will be made invalid.
Individuals are also urged to contact eHealth Saskatchewan’s Privacy Officer if they have noticed another individual’s name appear when their QR code is scanned.
The privacy officer can be contacted at privacyandaccess@eHealthsask.ca.
“We are working closely with our vendor to investigate and resolve any issues and prevent other problems,” Church said.
“We understand the high demand in Saskatchewan for records to meet proof of vaccination requirements.”
The release added that the individual whose name and information was erroneously captured has been contacted. The Office of the Information and Privacy Officer of Saskatchewan has been made aware of this issue.
On Saturday, residents will be able to download or print their proof of vaccination record. This record will still include their name and details about vaccines administered, but the QR code will be absent from the record.