[BreachExchange] Class action lawsuit over cannabis data breach receives 'dozens' of inquiries: lawyer

[Destry Winant]

https://calgaryherald.com/news/local-news/class-action-lawsuit-over-cannabis-data-breach-receives-dozens-of-inquiries-lawyer

Since filing a proposed class action lawsuit against Natural Health
Services Ltd. and parent company Sunniva Inc., law firm Diamond and
Diamond has received “dozens” of inquiries.

Darryl Singer, lead counsel on the lawsuit, said his office started to
get calls from people concerned about a data breach of Natural Health
Services patient information immediately after the lawsuit was
announced last week.

“Everybody’s concerns are fairly similar, and at the end of the day,
everybody that’s called us is quite happy to be part of the class
action,” Singer said.

Natural Health Services, which operates seven clinics in Canada for
patients seeking medical cannabis, identified there was a data breach
in their electronic medical record system between Dec. 4, 2018 and
Jan. 7, 2019. During that time period, records containing personal
health information of about 34,000 patients were accessed without
authorization, Sunniva said last week. The breach did not involve any
financial, credit card or social insurance number information.

“NHS has notified the patients whose data was accessed, provided
details about the breach and its investigation to date, and guidance
for other steps that patients can take to protect themselves,” Sunniva
said in a news release.

Dr. Mark Kimmins, president of NHS, said the company is taking the
situation “very seriously” and taking “the necessary steps to prevent
a situation like this from happening again.”

“In addition, we are working with law enforcement and the Office of
the Information and Privacy Commissioner of Alberta to investigate
this matter,” he said.

Singer said the lawsuit is structured as a national class action, so
the Toronto law firm is taking clients from across the country.

“A health services provider, which is what this company is, has an
obligation to safeguard the most sensitive, personal health
information of its patients, and that’s set out in legislation,”
Singer said.

Information disclosed as part of the breach includes diagnostic
results, health-care numbers, addresses, phone numbers and medical
information such as referrals and completed questionnaires, according
to Diamond and Diamond Lawyers.

Natural Health Services and Sunniva have not yet filed a statement of defence.