Click here to sign up for our free daily newsletter.
Minister Paul Merriman speaks to reporters on June 18, 2019 (Andrew Shepherd/980 CJME)

Health minister dismisses eHealth board, orders full review

Jan 12, 2021 | 12:58 PM

Big changes are coming to eHealth, just days after a privacy commissioner’s report heavily criticized the agency’s handling of one of Saskatchewan’s largest privacy breaches ever.

In a news release issued Tuesday, Health Minister Paul Merriman announced that the previous board of eHealth, which manages electronic records and leads information technology for the Saskatchewan Health Authority, has been dismissed.

In its place will be two Ministry of Health staff members: Associate Deputy Minister Denise Macza, who will serve as chair, and Assistant Deputy Minister Billie-Jo Morrissette, who will be vice-chair.

Their first order of business will be to start an independent review of the governance, management, and program operations at eHealth, which was a recommendation made by privacy commissioner Ron Kruzeniski in a report issued Friday.

“Our government takes the protection of personal health information seriously and we are greatly concerned by the findings and recommendations presented in Mr. Kruzeniski’s report,” Merriman said in the release.

“As committed, we are taking immediate action to address and review the governance, management and program operations at eHealth to ensure the organization responsible for protecting health information is meeting the serious expectations of Saskatchewan citizens.”

The previous board included seven individuals with a broad base of experience in the financial, medical, strategic marketing, education, legal, and insurance fields. Merriman expressed his confidence in the new two-person iteration, however.

“I am confident that the new Board appointments as an interim measure will provide closer oversight of eHealth by the Ministry of Health during the governance review,” he said in the release.

Kruzeniski’s office made 25 recommendations for the ministry, SHA, and eHealth to address the many shortcomings that led to a ransomware attack that lasted for more than two weeks and resulted in the potential breach of more than 574,000 files containing personal information. Merriman has committed to providing a response to all of them within 30 days.