Government and privacy officials are investigating a potential data breach involving the health data of hundreds of thousands of patients who have not yet been notified about an incident in the spring.

On Friday, Ontario Premier Doug Ford, Health Minister Sylvia Jones and the Information and Privacy Commissioner (IPC) all appeared to confirm that the data of patients using the Ontario Health atHome service may have been breached.

In a letter to Ontario Liberal MPP Adil Shamji, who first flagged the potential cyber attack, the IPC suggested he was correct when he said the incident occurred more than three months ago in March.

The IPC commissioner confirmed to Shamji that a report had been filed “that aligns with the circumstances and date described in your letter.”

Shamji had said the breach happened on or around March 17 and involved 200,000 patients.

A spokesperson for the IPC told Global News the watchdog had received reports of a breach from Ontario Health atHome — which did not report it until the end of May. The government didn’t confirm the breach until June 27, after questions at an unrelated news conference.

Get daily National news

Get the day’s top news, political, economic, and current affairs headlines, delivered to your inbox once a day.

“Ontario Health atHome notified our office of a privacy breach on May 30, 2025,” the spokesperson wrote. “At this stage, we are reviewing the circumstances of the incident and cannot share further details at this time.”

Jones said the public agency responsible was investigating.

“Ontario Health is absolutely investigating right now,” she said. “We have a division that focuses on any potential cyber breach, and as is standing operating (procedure) Ontario Health and Ontario Health atHome will notify if there has been any form of breach to individual patients, but that investigation is going on right now.”

With the breach potentially occurring in March and the IPC notified last month, it is unclear why patients potentially involved have not yet been notified. Shamji said they should have been notified long ago.

“I fundamental tenet of a breach of this nature — especially involving so many people — is to immediately notify those individuals,” he said. “They need to know that their personal information may be compromised and that they need to be monitoring things like credit scores.”

Ford appeared to suggest his office had not been informed, despite Ontario Health atHome telling the IPC about the breach a month earlier.

“We’ll find out where the gap is and why it wasn’t brought to our attention a lot earlier, but we’re glad the investigation is happening,” Ford said on Friday.

Global News sent questions to Ontario Health but did not receive a response ahead of publication.

The potential data breach is the latest issue in a difficult period for Ontario Health atHome, a rebranded and consolidated agency launched by the Ford government.

Supply shortages in the fall left more than 350 people receiving home and palliative care across the province without the medication or equipment they needed.

Delays in delivering supplies came after the government signed new contracts with private vendors for Ontario Health. As a result of the delays, the province had to refund $219,000 to people forced to buy their own medical supplies.

Shamji said the data breach was evidence of an agency which couldn’t function properly.

“Ontario Health atHome has been in disarray for months,” he said. “First with medication shortages and then with supply shortages, then with massive delays in care and now with the protection of personal health information. They’ve failed on all those things.”

&copy 2025 Global News, a division of Corus Entertainment Inc.