The Pharmacy Vendor's Slow Breach
Calder Pharmacy Group operates 22 pharmacies in Alberta and one in BC. Its US-based billing vendor, MedBill, processes claims and stores patient records, including medication profiles, prescriber details and diagnosis codes, on servers in Texas. On 14 April, MedBill discovered that an unpatched portal had been accessed by an unknown actor for 11 days; 8,100 Alberta patients and 240 BC patients were affected. MedBill's contract requires notification within 72 hours, but MedBill told Calder on 24 April, ten days later, and has not provided a full list of affected individuals. Calder's privacy lead wants to wait until the list is complete before notifying anyone. Calder has not contacted the Office of the Information and Privacy Commissioner of Alberta or the BC OIPC. Some patients have already posted on social media that their medication histories were exposed.
1. What are Calder's obligations as a custodian under Alberta's Health Information Act? Does the delayed vendor notice change the timeline?
Read the worked answer
Under Alberta's Health Information Act, a custodian must notify the OIPC and affected individuals without unreasonable delay when there has been a privacy breach involving health information and there is a risk of harm. Calder remains the custodian; MedBill is an information manager, and the contract does not transfer Calder's statutory responsibility. The 72-hour clause is a contractual obligation owed by MedBill, not the legal deadline for Calder's notification.
The ten-day delay by MedBill does not extend Calder's timeline. Calder knew on 24 April that a breach had occurred, that the affected data included medication and diagnosis information, and that thousands of patients were involved. Waiting for a complete list would compound the delay. Calder should notify the OIPC and affected individuals as soon as possible, using the information it has, and update the notification if the list changes. It should also contact the BC OIPC for the BC pharmacy patients and consider the professional college's expectations.
The social media posts are relevant because they show that harm may already be occurring and that patients know about the exposure. That strengthens the case for prompt notification and may require a public statement or call-center support.
2. How should Calder assess risk of harm and what should the notification contain?
Read the worked answer
The risk-of-harm assessment should consider the sensitivity of the information, the probability of misuse, the scope of the breach and the recipient. Medication profiles, prescriber details and diagnosis codes are highly sensitive; they can reveal mental health conditions, pregnancy, addiction or other private matters. The access lasted 11 days and the actor is unknown, which suggests a real possibility of misuse. The social media posts indicate that at least some data may be circulating. The lack of a complete list increases uncertainty, but it does not justify delay.
The notification should describe what happened, when it was discovered, the categories of information involved, the approximate number of patients, the steps Calder and MedBill have taken, and what patients can do. It should include a contact point for questions and explain whether there is evidence of misuse. Calder should avoid speculation but should not minimize the risk. For health data, patients may need guidance on monitoring explanations of benefits, watching for identity theft, and contacting their care providers if they notice unauthorized activity.
Calder should also notify the OIPC with the same core facts and its remediation plan. If the investigation later shows that the actor only accessed a subset of records, Calder can provide an update, but the initial notification should be timely and honest about the limits of what is known.
3. What vendor-management and governance fixes should Calder implement after the breach?
Read the worked answer
Calder should first remediate the contract. The contract needs enforceable security standards, audit or certification rights, subprocessor approval, a clear incident-notification timeline with escalation contacts, cooperation with regulator and patient notifications, and indemnity for vendor-caused breaches. The 72-hour clause failed in practice, so Calder should add escalation to a named executive, a requirement to provide interim facts within hours, and a right to terminate for non-cooperation. It should also require data minimization and deletion, because MedBill does not need every field it currently stores.
Second, Calder should conduct a vendor risk assessment for all information managers, not only MedBill, and tier them by data sensitivity and access. Critical vendors should be assessed annually and before renewal. Third, Calder should test its incident-response plan, including a tabletop exercise with the privacy lead, security, legal and communications. Fourth, it should maintain a breach register and report trends to the board or senior management.
Finally, Calder should review its monitoring of vendor security. The unpatched portal is a sign that contractual promises are not enough. Calder should require evidence of patch management and vulnerability remediation, and should consider whether storing Canadian health data in the US creates additional legal-access or transfer risks that require a PIA under Quebec-like rules or a contractual mitigation under Alberta law.