North Okanagan Pediatric Clinic

North Okanagan Pediatric Clinic operates as a pediatric healthcare provider located in Canada, serving the North Okanagan region with medical care focused on infants, children, and adolescents. The clinic delivers clinical services such as routine check‑ups, vaccinations, and treatment of acute illnesses while also managing preventive health programmes for its patient population. Administrative functions are handled through an electronic system that oversees patient scheduling, billing, and the storage of demographic information, personal health numbers, and billing codes. Paper medical records are maintained separately from this digital platform, ensuring that clinical notes remain isolated from the scheduling and billing databases. The clinic’s patient base includes both current and former individuals who have received care at the facility, as evidenced by the notification outreach conducted after the 2020 security event. Its headquarters is situated in Canada, establishing the organization within the national healthcare framework and subjecting it to applicable federal and provincial health‑privacy legislation. The clinic’s operational model integrates direct medical service provision with robust administrative support to maintain continuity of care and efficient practice management.

In May 2020 the North Okanagan Pediatric Clinic experienced a remote hacking incident that involved unauthorized access to its local systems, during which the electronic scheduling and billing infrastructure was targeted. The attacker’s primary activity appeared to be the encryption of system files in an attempt to extort a ransom, although no confirmed evidence emerged that actual patient information was viewed or exfiltrated. Despite the lack of confirmed data theft, the breach potentially exposed historical patient profile data, encompassing demographic details, personal health numbers, and billing codes linked to past appointments and transactions. In response to the potential privacy violation, the clinic proactively notified both current and former patients about the possible exposure of their information, fulfilling its duty to inform affected individuals. The incident was reported to the Royal Canadian Mounted Police and the provincial Privacy Commissioner, reflecting compliance with mandatory breach‑notification requirements under Canadian health‑privacy statutes. These actions demonstrate the clinic’s commitment to transparency, its adherence to regulatory obligations, and its recognition of the sensitivity inherent in handling pediatric health data. The episode also underscores the importance of securing electronic administrative systems within healthcare settings, particularly those that manage scheduling, billing, and related personal identifiers.