'Significant' weaknesses found in WRHA's cybersecurity, report says

An audit has found flaws intheWinnipeg Regional Health Authority's cybersecurity that leftpersonal health informationvulnerable to falling into the wrong hands.

Manitoba's Auditor General Norm Ricardreleased a report Wednesday after looking into the WRHA's management of risks associated with end-user devices (personal computers, smartphones, tablets).

"Healthcare organizations must ensure they are properly protecting the sensitive information that is accessed from, and stored on, these devices," Ricardsaid in his report.

The audit found the WRHA was not identifying the risks to personal health information accessed by end-user devices and that there were weaknesses in itscybersecurity controls.

"Because of these significant cybersecurity control weaknesses, the WRHA was unnecessarily vulnerable to personal health information falling into the wrong hands," said Ricard.

The report notes the WRHA was focused on ensuring compliance with the Personal Health Information Act, including its security requirements,"but compliance to the PHIA security requirements does not ensure strong cybersecurity," Ricard said.

"We believe that focusing first on a cybersecurity program based on sound risk management would better protect personal health information and invariably result in compliance with the Act's security requirements."

The report contains 12recommendations for both theWRHAand the provincial health department.