Birth certificates, medical imaging, passports, prescriptions, biopsy reports, mental health assessments and more — the personal information and medical records of an unknown number of patients were publicly available on the website of a Vancouver marijuana dispensary until recently.
It is not clear whether the information was exposed accidentally or for some malicious purpose. Dispensary management said they had notified the Office of the Information and Privacy Commissioner of B.C., who confirmed an investigation was underway.
The breach prompted Health Canada to reiterate warnings about cannabis dispensaries, which are still illegal under federal law.
Issues of privacy and pot made headlines last week after Ottawa’s largest marijuana dispensary chain apologized to angry customers for accidentally revealing email addresses. The scope of the Vancouver dispensary’s records goes beyond patients’ names and emails, including scans of medical records and identifying documents belonging to Canadians from several provinces.
Late last month, a tipster told Postmedia that the information was publicly accessible, without a password, on the website of Vancouver Pain Management Society.