Notice of Cyber Incident

On December 8, 2024, Inner City Family Health Team became aware of a cybersecurity incident. Our investigation has confirmed that the personal health information of some of our clients was accessed.

Upon discovering the incident, we retained cyber forensic experts to conduct a comprehensive investigation. Based on the investigation to date, we want you to know that you are affected if you are in any of the following groups:

Affected group	Information exposed
All ICFHT clients who had an appointment between August 1, 2021 and November 30, 2024.	Client name, EMR number(s), appointment booking date, appointment date, healthcare provider name, appointment type and appointment status
All registered users of Substance User HUB between January 1, 2022 and September 30 2024.	Client name, client date of birth, EMR number(s), gender, ethnicity and sexual orientation.
All clients who shared paper medical records with ICFHT, either directly or through a third-party healthcare professional. For example, impacted paper records include: Client referral forms Client psychological assessments Chart notes Chart Records Support Letters Client Lists Lab/Specialist results Prescriptions Consent Forms Intake Forms	The medical information on these forms varied widely, and included case history, diagnostic and other clinical information. Please contact ICFHT at privacy@innercityfht.ca to learn more.

It is important to note that our Electronic Medical Record system was not impacted, and we experienced no disruption to healthcare or other services we provide. There is no evidence of further misuse of the data, and we have been told the data has been deleted.

We are committed to securing your information and will continue to reenforce our commitment through improved security practices and technology investments. We have rebuilt our systems to ensure that the perpetrators of this attack and their malware were removed. We have also made improvements to our cybersecurity and continue to investigate ways to improve our network.

We are also focused on accountability. We promptly reported the incident to the Information and Privacy Commissioner of Ontario (“IPC”), Toronto Police Service, and Ontario’s Ministry of Health. You are entitled to make a complaint to the IPC under Part VI of the Ontario Personal Health Information Protection Act, 2004. For more information, please visit the IPC website at https://www.ipc.on.ca/ (Address: 2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8; Telephone: 416-326-3333, 1-800-387-0073).

If you have any questions about this incident, please contact us at privacy@innercityfht.ca.

We deeply regret that this incident occurred and remain committed to providing quality patient care and protecting your privacy.

Sincerely,
Tara Bradford
Executive Director, Inner City Family Health