Healthcare Data: Are You Required To Report A Ransomware Attack?

If you are a healthcare data custodian that is subject to a ransomware attack, you may be required to report the incident to regulators and to those individuals whose information was subject to the attack.

Ransomware attacks typically involve a hacker encrypting user data until the custodian pays a ransom to have the hacker provide a decryption key. The hacker is not necessarily able to view the data.

Part I of the federal Personal Information Protection and Electronic Documents Act (PIPEDA)¹ does not apply to health data custodians collecting, using or disclosing personal information in Ontario.² Instead, healthcare data storage in Ontario is regulated under the Personal Health Information Protection Act, 2004 (PHIPA),³ which the Governor in Council of Canada has deemed to be substantially similar to PIPEDA.⁴