N.L.'s new online personal health record system is secure, says official

CBC
·4 min read
The government's online service portal, MyGovNL, was unveiled in 2019 and has seen its users explode since the pandemic.
Stephen Greene, Newfoundland and Labrador Health Services’ chief information officer and vice-president of digital health, says people can now sign up to access their personal health records through the government's online service portal, MyGovNL. (Lindsay Bird/CBC)

Newfoundlanders and Labradorians can now access their personal health records online, to check information like prescribed medications and test results — and a provincial health official says it's secure.

According to the provincial health authority's website, users have to be residents of N.L. and 16 years old or older, and have a valid MCP plan, a valid driver's licence or government issued photo ID, and an active account with the the government's online service portal MyGovNL.

Stephen Greene, Newfoundland and Labrador Health Services' chief information officer and vice-president of digital health, said the system will allow people to have secure access to their personal health record.

The online accessibility will help patients monitor any chronic conditions and medications, he said, which will make people more involved and informed about their health care.

He said the online personal health care records are secure.

"Privacy and security of personal health information is of the utmost importance to us. The personal health record portal leverages the highest privacy standards so that people of the province can be assured that their information is protected," Greene told CBC News.

Greene added they've added multiple authentication checks. People who opt in to the service will match their online record to their MCP record and driver's licence.

In 2021 a devastating ransomware cyberattack stole 200 gigabytes of data and paralyzed the province's health-care system.

A 115-page report from the Office of the Information and Privacy Commissioner found that the Department of Health and Community Services had received warnings about its vulnerable system before the attack but didn't act on the information.

'Cautiously optimistic'

Jonathan Anderson, a Memorial University associate professor and a computer security expert, says these types of online services are a "balancing act" between security concerns and empowering people with more information.

"The thing about balancing acts is you can lose your balance," Anderson told CBC News.

So far, he described himself as "cautiously optimistic" about the program and — as a privacy security researcher — he is in the process of signing up and is waiting for his code in the mail.

Jonathan Anderson is an associate professor at Memorial University with a focus on computer security and privacy. He has a PhD from the University of Cambridge.
Jonathan Anderson, an associate professor at Memorial University with a focus on computer security and privacy, sys he’s cautiously optimistic about the new online program. (Mark Cumby/CBC)

"Certainly one of the issues that can happen in large, complex, bloated, very, very old IT systems is they get hidden away from the light for a long time," he said in an interview.

"They don't update, they don't adapt, they don't have to evolve. And that can lead to systems that are really very vulnerable."

He is glad to see two-factor identification as part of security measures, though he'd like to see additional features such as an authenticator app.

He said he looked into MyGovNL's code and said he found some potential vulnerabilities, so he'd like to see evidence that the system is being maintained.

"There's nothing that would, like, make red alarm bells go off. But on the other hand, there are some things to be careful about."

Information rolled out

Greene said the health authority is making only certain information — including laboratory results, X-ray reports and medications — available through the online service at this time, but plan to expand the files offered in time. How far back the files go varies by health region and the type of service, he said, but the health authority also plans to eventually include older records.

He said 51,000 people have signed up for the personal health record and more than 26,000 people have logged in to access their own information.

There is a delay from when the results are received and when they are uploaded to the online portal, he said. There's a seven-day delay in when lab results are released on a person's online record, whereas X-ray reports have a 14-day delay.

"This was actually done in consultation with clinicians involved in the project to ensure that they have adequate time to inform the patient or reach out to the patients," said Greene.

Download our free CBC News app to sign up for push alerts for CBC Newfoundland and Labrador. Click here to visit our landing page.