Thousands more affected by PharmaNet privacy breach, government reveals

An arrest has been made in the breach of B.C.'s PharmaNet system, andthe scope of the criminal activity has grown, the provincial government announced Monday.

PharmaNet is the province-wide network that links all B.C. pharmacies to a central set of data systems. Every prescription dispensed in B.C. is entered into PharmaNet.

In a statement, the province said the VPD arrested an individual on March 23 in Richmond, five weeks after the breach was first revealed.

Originally, the government said 7,500 British Columbiansmay have had their personal information viewed by people illegally accessing the PharmaNet system, which links all B.C.pharmacies to a central information system.

But on Monday, the government revealed an additional 13,000 people may have had theirPharmaNet profile and/or medication history viewed inappropriately. In addition, the Vancouver Police Department has confirmed that in some cases, the information accessed was used for fraudulent purposes.

A previous breach in 2014 by an unknown hacker affected approximately 1,600 patients.

• PharmaNet breach compromises personal information of 7,500 B.C. residents, says province
• 'Serious deficencies' blamed for 3 B.C. health data breaches
• Less than half of B.C. doctors thoroughly check patients' prescription history, says researcher

"For the most part, the individual accessed basic demographic/profile information. However, in some instances, medication history for the past 14 months was viewed, which includes drug name, dose, date, prescribing physician and dispensing pharmacy," said the VPD in a separate statement.

The government is now offering free credit monitoring services to all 20,500 individuals possibly affectedand is in the process of contacting them with details on how to access the service.

"The Ministries of Health, Finance, and Technology, Innovation and Citizens' Services have undertaken a significant amount of work since discovering these incidents. These actions include containing all known PharmaNet incidents, shutting down affected accountsand disabling accounts that have been inactive for more than 30 days," said the government.

"The Ministry of Health is implementing more robust security measures with PharmaNet vendors and is installing cautionary banners that stress the legislative requirements for using PharmaNet upon signing in."

No charges have been laid in the case yet, and the government says it is unable to provide more information because of the ongoing nature of the investigation.