Pagers at UHN disabled after patient data exposed

TORONTO – The University Health Network (UHN) has changed the way it uses pagers to communicate after a local radio station discovered the health information of more than 200 patients was easily accessible to the public.

According to 680 News, a computer programmer came across the information of 223 Toronto General Hospital and Toronto Western Hospital patients in late January. He was able to access the information, contained in hospital pager messages, from his home more than 10 km away.

“I started to see the names of patients, their date of birth, blood test results, even requests to transport patients who had died to the hospital morgue,” said the computer programmer speaking on the condition of anonymity.

Pagers can send signals strong enough to travel across the Toronto region instantly, but the messages from most have no protection. UHN confirmed it has used this unencrypted system for decades. The Information and Privacy Commissioner of Ontario is now investigating.

Almost anyone can get their hands on the pager data with $20 worth of hardware and two free software programs, the programmer said.

“You don’t need to be an expert. You just need to be able to follow instructions that tell you what to click on and just apply some very basic sense,” he said.

After 680 News asked the UHN about the exposed data, the hospital network changed its system to stop transmitting private patient information through pagers.

“We turned off any communication of personal health information over the paging systems,” said David Jaffray, executive vice president of technology and innovation at UHN. “We reached out to our staff and reminded them of the importance of not putting patient health information on systems without encryption, like the pagers. We also reached out the Ontario privacy commissioner.”

According to Ontario’s health ministry, hospitals are required to take steps to ensure that personal health information in their custody or control is protected against unauthorized use or disclosure.

UHN is in the process of contacting affected patients.