Nova Scotia Health Authority

The Nova Scotia Health Authority (NSHA) functions as the primary healthcare delivery organization for the Canadian province of Nova Scotia. As a provincial health authority, it is responsible for the planning, coordination, and provision of medical services to the province's residents. This includes the operation of hospitals, community health centers, and various specialized care facilities across the region. The NSHA manages extensive volumes of personal health information, such as patient records, health card numbers, and other sensitive data essential for clinical and administrative operations. Its mandate positions it at the core of the provincial healthcare system, requiring direct interaction with patients, healthcare professionals, and government entities. The authority's operations are fundamentally linked to the stewardship of confidential health data, subjecting it to rigorous Canadian privacy and security regulations. While specific quantitative details about its size or exact number of facilities are not provided, its designation as the central health authority confirms a substantial operational footprint throughout Nova Scotia. The organization's role is integral to the province's public health infrastructure, serving as the key entity for publicly funded healthcare services.

The NSHA's custodianship of sensitive personal data has been highlighted by two documented cybersecurity incidents. In May 2019, a phishing attack compromised an employee's email account, potentially exposing the personal health information of approximately 3,000 patients. This event demonstrated the vulnerability of internal systems to social engineering and the resultant risks to patient confidentiality. A larger-scale breach occurred in May 2023 via a vulnerability in the MOVEit file transfer service, which affected the NSHA alongside other provincial government departments. This incident led to the theft of significant data volumes, impacting hundreds of thousands of individuals. The exfiltrated information included names, birthdates, addresses, health card numbers, and, in some instances, social insurance numbers. The affected population extended beyond patients to include teachers, students, public servants, and correctional facility inmates, illustrating the interconnectedness of government data systems and the broad ripple effect of such security failures. These breaches underscore the NSHA's critical function as a repository of highly sensitive information and the persistent cybersecurity threats confronting large public sector health organizations. The incidents have invariably shaped the authority's approach to data protection and compliance with provincial and federal privacy statutes.