Health PEI Notice of Privacy Incident

Health PEI is notifying the public about a privacy incident involving a file created in 2011 containing personal health information. The file relates to individuals who were eligible for healthcare services in PEI during or before 2011, as well as some non-residents who received health services in PEI between 2008 and 2011.

An unauthorized person obtained this file during a cybersecurity incident affecting a company that was providing services to Health PEI.

Based on the information available today, Health PEI believes the risk that this information will be misused is low. We recognize, however, that learning about a privacy incident involving your personal health information may be concerning. 

We are providing this notice in the interest of transparency and to ensure that potentially affected individuals are aware of the incident and know what steps they can take.

Health PEI has reported the incident to the PEI Information and Privacy Commissioner, and the Commissioner’s office has opened a file. Information and updates from the Commissioner's office will be available at www.oipc.pe.ca. Law enforcement has also been notified.

Who may be affected

The affected file was created in 2011 and relates to individuals who were eligible for healthcare services in PEI during or before that period.

Your information may have been included in the file if you:

• had a PEI health card number in or before 2011; or
• were a non-resident of PEI who received health services in PEI between 2008 and 2011.

Information involved

The file contained some or all of the following information about affected individuals:

• Identifying and demographic information: first name (including middle initial or name), last name, date of birth, date of death (where applicable) and gender
• PEI Personal Health Number (PHN)
• Medicare eligibility information: start and end dates, eligibility code, eligibility end reason
• Health card information: issue date, expiry date, and health card reason code

What happened

A company providing services to Health PEI experienced a cybersecurity incident involving unauthorized access to its systems. An unauthorized person obtained a copy of a Health PEI file during the incident.

The incident was limited to the company’s systems. Health PEI and Government of Prince Edward Island systems were not compromised or impacted, and records stored within government systems were not accessed inappropriately. 

The company is reviewing its processes and implementing measures to reduce the risk of a similar incident happening again.

Risk to individuals

Based on the information available today, Health PEI believes the risk that the information will be misused is low.

What you should do

Be alert for suspicious emails, text messages, or telephone calls that request personal information or claim to relate to health coverage, government programs, or identity verification. Always verify the identity of anyone requesting personal information.

If you receive suspicious communications or notice activity that you believe may be related to this incident, please report it to Health PEI. These reports will help us monitor the situation and assess whether the risk has changed.

Contact information

Individuals who wish to report suspicious communication or activity, or who have questions about this notice, may contact:

Health PEI Privacy Office
Telephone: 1-800-375-3503 (toll-free)
Email: privacybreach2026@ihis.org