Underfunding of aging Sask. health-care IT systems makes risk to patient lives 'inevitable': gov't memo

A blunt briefing note prepared for Saskatchewan's Minister of Health warns that eHealth, which runs the province's health-care IT system, has been underfunded for years and is at growing risk of failure, which could potentially affect patient safety. 

eHealth is a Crown corporation responsible for operating, maintaining and renewing all computer systems that serve the health-care sector, from diagnostics to pharmaceuticals to patient records. 

The Oct. 26, 2020, document, written by eHealth and obtained by CBC through an access to information request, says that many of eHealth's hardware and software systems are out of date and "major outages that impact patient care delivery are increasing at a rate of 25 per cent per year."

It says that as time goes by, the risk to patient will grow unless the government steps up with millions in additional funding. 

"A major equipment failure which may disrupt service and risk lives appears inevitable with the current funding model," the briefing note warns. 

Aging systems at risk

The document  goes on to highlight the areas that are at risk. 

• Admitting charting and hospital registration systems.

• Laboratory diagnostics.

• Medical imaging diagnostics.

• Hospital pharmacy systems.

• Contact tracing.

• Vaccine inventory and public health services.

• MySaskHealthRecord.

The note says that despite the growing risk, government investment in the infrastructure hasn't nearly kept up. 

"Over the past five years, funding has remained virtually static." 

eHealth says it provides IT equipment and support for about 400 health-care facilities across Saskatchewan. In a series of bullet points, the organization highlights problems it has identified:

• "Some of the equipment is so old, automated systems can't be used to identify the PCs and laptops that are currently connected to that system."

• "No archival records exist of what's being used by whom."

• About 25 per cent of PC's in the system are more than five years old and running on old operating systems which, "makes it impossible to apply the latest and most up-to-date security patches."

• "The Electronic Health Record (which collects and manages all patient records) runs on an Oracle database and has reached the end of its useful life." The note adds that the platform this record is based on has been around since 2010 and "is no longer supported."

In its briefing note, eHealth tells the minister that an immediate and ongoing cash injection is required. 

"To meet current expectations of customers and mitigate unacceptable risks to patient safety, eHealth will require an additional investment of $50 million per year above its historical base budget for the next three fiscal years," the note says. That base budget from the provincial government is about $110 million annually.  

That means eHealth is asking for a 45 per cent increase in its annual budget. 

According to a recent provincial auditor's report, the current value of eHealth's computer systems — including hardware and system development costs — sits at $6 million.

The briefing note suggests that some of these problems stem from the amalgamation of 12 health regions into one in 2017-18. eHealth was responsible for integrating all of the computer systems.

In the past, individual regions would fund outdated technology on an ad hoc basis, the note says. 

"Problems were solved through one-time capital allocations, taken from base budgets. Since amalgamation, this no longer takes place," the note says, adding that since that time new investment has been limited.

CBC asked Minister of Health Paul Merriman for an interview about the briefing note.

He provided a written statement.

"Any information regarding the health and lives of Saskatchewan residents being put at risk is concerning," said Merriman. "I will be asking Ministry of Health officials to look into this matter and to find ways to improve the systems supported by eHealth."

A follow-up note from the ministry pointed out that an "additional $21M was allocated this year to eHealth to enhance IT infrastructure."

Read the entire memo here:

Ransomware attack highlights vulnerability

Vicki Mowat, the opposition critic for eHealth, said the NDP has been raising the issue of aging medical IT infrastructure for years. 

"It's quite concerning to see that during a pandemic these system failures are expected," she said. "We're talking about services that people rely on like contact tracing, vaccine inventory.

"It's incredibly concerning that lives are at risk because the government is sitting on their hands when it comes to health care."

Mowat said a lack of new investment is particularly surprising given the vulnerabilities that were exposed in eHealth's system after a ransomware attack one year ago. 

• eHealth hit by ransomware attack but personal health data is secure, says CEO
• eHealth ransomware attack potentially catastrophic for Sask. health card holders: cybersecurity expert

That attack is currently under investigation by Saskatchewan's information and privacy commissioner. 

According to the provincial auditor, the cyberattack was costly and harmful. 

"This attack led to a serious business disruption. It affected the ability of over 40,000 health sector employees to work effectively. eHealth also incurred significant costs to respond to the attack," she wrote in a Dec 8, 2020, report. 

In that report, she also noted that eHealth still doesn't have a disaster recovery plan for future cyberattacks. Her audit found that 38 eHealth systems didn't have full recovery plans. 

• Sask. auditor's report says eHealth doesn't have full recovery plans for future cyberattacks

"I can't believe that after that this still hasn't been made a priority and there's such a lack of transparency about how bad the situation actually is," Mowat said.