Vancouver Coastal Health

Vancouver Coastal Health (VCH) is a regional health authority responsible for delivering healthcare services to communities along the coast of British Columbia, Canada. It operates a network that includes hospitals, community health centres, and a variety of public health and wellness programs. The organization's mandate covers acute care, primary care, mental health and substance use services, and population health initiatives such as disease prevention and health promotion. VCH serves a diverse population across both urban centres like Vancouver and numerous rural and remote coastal settlements, adapting its service delivery to meet geographically varied needs. A component of its offerings is the Employee and Family Assistance Program, which provides support resources for staff and their families. As a publicly funded entity, VCH functions under the provincial framework of British Columbia's health system, coordinating with the Ministry of Health and other regional health authorities. Its workforce encompasses a broad spectrum of clinical and non-clinical personnel dedicated to maintaining community health. The authority's operations are governed by provincial health legislation, requiring adherence to standards for patient care and the protection of personal health information. Funding is allocated primarily through the provincial government, aligning with its role as a key provider of essential public services.

In May 2020, VCH was the target of a ransomware attack that compromised systems related to its Employee and Family Assistance Program. The health authority immediately engaged external cybersecurity specialists to contain the incident, investigate its scope, and guide the recovery process. Following a comprehensive forensic review, VCH publicly stated that no evidence was found to indicate any data was stolen or exfiltrated during the attack. This event highlights the acute cybersecurity risks confronting healthcare organizations, which manage highly sensitive personal and medical data attractive to malicious actors. VCH's response protocol, which involved bringing in outside experts, reflects a recognized practice for handling sophisticated cyber intrusions when internal resources may be insufficient. The authority's communication about the incident, including its conclusion regarding data theft, demonstrates an approach to transparency with stakeholders following a security breach. The attack tested the resilience of its digital infrastructure, though core patient care services were reportedly not disrupted, suggesting effective system segmentation. This incident serves as a documented example of the cyber threats faced by public health entities and the procedural steps taken in response, within a sector that continuously works to strengthen its defensive postures against evolving digital threats.