WRHN patients warned of security breach involving personal health information

WRHN @ Midtown was seen on King Street West in Kitchener on April 8, 2025. (Dan Lauckner/CTV News)

The Waterloo Regional Health Network (WRHN) is advising patients of a security breach that potentially involves their personal health information.

On Feb. 6, Ontario MD notified WRHN about a connection issue with the Health Report Manager, a tool used by the hospital network to share patient information with primary care providers. The system is also hosted by Ontario Health.

A notice, published to WRHN’s website on Feb. 20, said it had not yet “determined whether any personal health information was impacted.”

Letters were sent out to patients on March 27 with an update on the investigation.

“While the evidence remains inconclusive, there is a possibility that [personal health information] has been compromised that we cannot rule out,” it said. “The information potentially exposed includes clinical information related to the treatment you received from the hospital between April 26, 2025 to January 13, 2026.”

CTV News reached out to WRHN for additional details on the breach. While no one was made available for an interview, they did provide a statement.

“The incident originated outside WRHN’s network at a third-party service provider, was contained within hours of identification on Jan. 13, 2026, and did not affect WRHN’s internal systems, clinical records or patient care,” it said. “While the investigation indicates a low likelihood that personal health information was accessed or misused, [Health Report Manager] reports related to approximately 150,000 patients who received care between April 2025 and January 2026 may have been involved.”

Anyone potentially impacted was alerted “out of an “abundance of caution.”

The WRHN letter also warned patients to keep an eye out for any “suspicious communications related to your health and your health care.” They can contact the health network at 519‑744‑4248 or [e-mail].

“We sincerely apologize for this incident and any distress it may cause,” WRHN said.

The health network noted the security breach had already been reported to the Information and Privacy Commissioner of Ontario (IPC), but patients could submit their own complaint if they wanted.

In an email, the IPC said they were notified of the privacy breach on Feb. 9.

“If someone feels that their personal health information has been impacted by this incident they can file a complaint with our office, though it is not necessary as we are already looking into the matter," the email said.

CTV News reached out to OntarioMD who had no comment on the matter. Ontario Health has not responded to a request for an interview.