ÎÚÑ»´«Ã½

Skip to content
Join our Newsletter

Database insecurity the latest in a string of problems at Provincial Health Services Authority

A look at the history of turmoil at PHSA over the last 10 years.
Cyber-criminal-creditYagiStudioGettyImages
Privacy Commissioner Michael McEvoy found that PHSA knew since at least 2019 that the Provincial Public Health Information System, aka Panorama, was riddled with security gaps and little was done to solve the problem

It has been a terrible, horrible, no good, very bad decade at the Provincial Health Services Authority (PHSA), ÎÚÑ»´«Ã½’s sixth health authority. 

The latest headlines surround the Information and Privacy Commissioner’s Dec. 15-published report, called Left Untreated: Security Gaps in ÎÚÑ»´«Ã½’s Public Health Database.

Michael McEvoy found that PHSA knew since at least 2019 that the Provincial Public Health Information System, aka Panorama, was riddled with security gaps and little was done to solve the problem. 

“Every British Columbian should be troubled by these findings, because it means personal information in the system is vulnerable to misuse and attack,” McEvoy wrote. 

PHSA was incorporated under the Societies Act in 2001, early in Premier Gordon Campbell’s administration, with a board appointed by the Minister of Health. 

It boasts a $4.5 billion annual budget with a diverse roster of provincial agencies covering cancer, HIV/AIDS, kidney, cardiac, mental health and addiction and organ transplants. 

PHSA also runs ÎÚÑ»´«Ã½ Children’s Hospital, ÎÚÑ»´«Ã½ Women’s Hospital, ÎÚÑ»´«Ã½ Emergency Health Services, Health Emergency Management ÎÚÑ»´«Ã½ and the ÎÚÑ»´«Ã½ Centre for Disease Control. 

A look at the history of turmoil at PHSA over the last 10 years.

CEO out 

The BC Liberals mandated a management and executive pay freeze across government in late 2012. Did the memo reach PHSA? 

CEO Lynda Cranston was forced to resign at an emergency board meeting in June 2013 after $660,115.13 in unauthorized raises for 187 managers.

“The board believes processes are now in place that will assist us and the government to ensure that this error does not happen again,” said then-chair Wynne Powell. “Our main goal for PHSA is to put patients first and provide quality care at all times.”

Naughty list

It was Christmas party season in 2013 when ÎÚÑ»´«Ã½ EHS president Michael MacDougall and ÎÚÑ»´«Ã½ Ambulance Service chief operating officer Les Fisher were suddenly and mysteriously suspended. 

PHSA told the public three months later, in March 2014, that the duo had quit after an investigation by Vancouver law firm Roper Greyell. Powell refused to say what went wrong, except that there was no fraud or corruption. 

“I can’t, underneath the privacy regulations, disclose that,” said Powell, a longtime London Drugs executive. “I’m sorry, I wish I could.”

Dutch departure

Only two years into the job of leading ÎÚÑ»´«Ã½’s fight against cancer, Dutch import Dr. Max Coppes left the ÎÚÑ»´«Ã½ Cancer Agency in October 2014. 

After the announcement, it was revealed that his CEO salary was topped-up by the charity arm, the ÎÚÑ»´«Ã½ Cancer Foundation. The foundation and PHSA agreed to an additional $375,000 package over five years to supplement the $561,000 paid annually to Coppes.

PPE scandal, part 1

Before the COVID-19 pandemic, the PHSA’s Health Care Supply Chain department was buying $2 billion a year of equipment and materials for hospitals across the province. 

But it didn’t buy enough to prepare for a pandemic entering 2020. 

The ÎÚÑ»´«Ã½ government built stockpiles, including quantities of personal protective equipment, after the SARS and H1N1 pandemics. Stocks were not replenished under the NDP, which came to power in 2017. 

A PHSA memo in February 2020, obtained under freedom of information, said low inventories “will likely not meet ÎÚÑ»´«Ã½’s requirements which may lead to a public safety risk.”

The situation was so dire, that in late March 2020, Premier John Horgan’s deputy minister ordered government workers to hunt for N95 masks in earthquake kits under desks in government offices across the province. The masks were earmarked for delivery to frontline doctors and nurses. 

PPE scandal part 2

Benoit Morin became the new CEO at PHSA in February 2020, weeks before the pandemic emergency was declared. 

He spearheaded the $6.95 million purchase of N95 masks in March 2020 from a Montreal company, Luminarie. The China-manufactured goods arrived the next month, but failed provincial testing protocols. Many of the masks were deemed counterfeit.

The PPE purchase, spending on office renovations and staff departures prompted the Ministry to commission a report by Ernst and Young. Morin was fired, with severance, from his $352,000-a-year job the day it was released in February 2021.

Medical device madness

On the same day as the report on Morin, Auditor General Michael Pickup said he found that PHSA had not evaluated all cybersecurity threats and their potential harm to patients. Medical devices were especially lacking in standard cybersecurity protections at PHSA.

Coughing epidemiologist

Just 10 days after Morin’s firing, PHSA tried to turn the page at its first open board meeting of the year. 

Chair Tim Manning, a retired banker, and directors appeared on a webcast from three boardrooms at headquarters. Nobody wore a mask, contrary to the health authority’s own workplace health and safety rules, that said masks were required in meeting rooms, even when physical distancing is possible. 

When a reporter pointed that out, PHSA changed the website to say masks were required when moving in or out of meeting rooms.

One of the directors, Dr. Ken Bassett of the University of ÎÚÑ»´«Ã½ Therapeutics Initiative, is an epidemiologist and he occasionally coughed throughout the meeting. 

Pickup dropped another 

At the end of August 2021, Pickup zeroed in on PHSA’s $66 million write-off of masks, gloves, goggles and other pandemic gear. 

Instead of specialized inventory management software to track goods between warehouses, the auditor general found that PHSA used Google Spreadsheets. Warehouse staff did not complete inventory reconciliations on time and even had to re-count $100 million worth of inventory at one warehouse due to errors.

A June 2021 briefing note, obtained under FOI, found PHSA spent $465 million on PPE during the first fiscal year of the pandemic. 

Fake nurse

A year ago, on Dec. 16, 2021, gynecological surgery patient Miranda Massie filed a class action lawsuit in ÎÚÑ»´«Ã½ Supreme Court against PHSA, claiming that it allowed a fake nurse to administer treatments at ÎÚÑ»´«Ã½ Women’s Hospital without her consent. 

In November 2021, Vancouver Police Department announced charges of fraud over $5,000 and personation with intent against Brigitte Cleroux. Cleroux had worked at the hospital between June 2020 and June 2021 and had no certification to act as a nurse. Another 15 charges were laid in September.

Massie’s lawsuit alleges PHSA failed to do standard background and reference checks before hiring Cleroux, who is now serving a seven-year jail sentence in Ontario.

Heat dome

Two PHSA agencies failed in the 2021 heat dome disaster that led to the deaths of 619 people. 

Email obtained under freedom of information shows that Health Emergency Management ÎÚÑ»´«Ã½ officials were slow to warn the public that record, punishing heat was on the way and deaths were likely. 

ÎÚÑ»´«Ã½ EHS did not activate its emergency operations centre until June 29, five days after the heat wave arrived. By then it was too late. 

At the open EHS board meeting on June 24, 2021, Neil Lilley, the senior provincial director of patient care, communications and planning, joked that the nurses hotline would be fielding more severe sunburn calls during the heat wave. “8-1-1 might be busy, but hopefully not,” he said. 

In mid-July 2021, Health Minister Adrian Dix replaced EHS chief operating officer Darlene MacKinnon with a new chief ambulance officer, Providence Health executive Leanne Heppell. He also installed former Vancouver Police Chief Jim Chu as the board chair. 

Code Orange

It only lasted a half-hour, but it was a half-hour too long. 

At 6:35 a.m. on Dec. 3, ÎÚÑ»´«Ã½ Children’s Hospital declared Code Orange, due to too many patients and not enough emergency doctors and nurses to handle them. 

The hospital has struggled throughout the fall to keep up with a surge of children suffering influenza, COVID-19 and lung infections from Respiratory syncytial virus (RSV). 

Wait times as long as 12 hours had been reported during the week previous on the emergency wait times website.