News Industry Updates Legal Medical Security
Sunniva Inc. responds to data breach lawsuits

Sunniva Inc. announced its intentions to defend against class action lawsuits filed against the company in connection to a data breach earlier this year.

“From the time we initially became aware of this issue, we have taken all the necessary steps to prevent a situation like this from happening again in the future,” said NHS president Dr. Mark Kimmins in a statement. “We continue to work with law enforcement and the Office of the Information and Privacy Commissioner of Alberta in the ongoing investigation into this matter.”

The cannabis company and its Canadian subsidiary, Natural Health Sciences Ltd. (NHS), have been named in a parallel class action lawsuit in the Court of Queen’s Bench in Alberta on Sept. 9. It is a parallel filing to a previous claim on March 29 in the Ontario Supreme Court of Justice.

The data breach in the company’s electronic medical record system resulted in unauthorized access to personal health information of about 34,000 medical cannabis patients. The company claims that the breach did not involve financial, credit card or social insurance number information as it does not collect that information from patients.

However, Toronto-based law firm Diamond & Diamond Lawyers LLP, which filed the Ontario lawsuit against the company last March, said the breach might have disclosed diagnostic results, health care numbers, other medical information, and specific identifying information, like patients’ name, age, gender, addresses and phone numbers.

Diamond & Diamond representatives claim the data breach could impact patients’ insurance rates, ability to travel and possibly subject patients to fraud.

“What is more integral than the preservation of our health information?” said managing partner Jeremy Diamond in a statement in March. “All individuals that filled out these online forms could be affected by this egregious breach.”

NHS currently manages information of 105,000 registered patients across seven medical cannabis clinics in Canada. It notified patients last March of the data breach which took place between Dec. 4, 2018 and Jan. 7, 2019. The company also established a patient hotline to field inquiries at 1-888-297-0573.

NHS announced that it is currently conducting its own privacy investigation through a third-party consulting firm which specializes in cybersecurity.