BC's Vulnerable Health Records - The Risks of Crash Victims with No Oversight Over Their Records
OIPC Investigation Report 22-02 (Left untreated: Security gaps in BC's public health database): December 15, 2022 - Found major systemic deficiencies and inadequate security protections across shared public health database infrastructure. OIPC Investigation Report 22-02 (Left untreated: Security gaps in BC's public health database)
OIPC Investigation Report F10-02 (The PARIS System Investigation): March 11, 2010 - Review of the Electronic Health Information System at Vancouver Coastal Health Authority. Violated FIPPA standards by utilizing a team-based access model that allowed massive, excessive, and unauthorized employee access to highly sensitive patient case notes and diagnoses: https://www.oipc.bc.ca/documents/investigation-reports/1174
BC OIPC Investigations Directory: For a wider search or context on similar public sector compliance audits and systemic privacy breaches, you can browse the OIPC BC Investigation and Audit Reports Database: https://www.oipc.bc.ca/reports/investigation-and-audit-reports/
Widespread ICBC Direct-Billing Portal Vulnerabilities (Documented 2025): Province-wide complaints showing that ICBC’s standardized direct-billing contract terms force healthcare providers to grant broad, unmonitored computer system access for "Performance Management," critically compromising practitioner-patient confidentiality, HIPA/FIPPA boundaries, and data integrity.
Concerns raised over new ICBC rules for health-care providers.
Global News: https://globalnews.ca/news/11023579/concerns-new-icbc-rules-health-care-providers/
OIPC Investigation Report 26-02 (Privacy breaches following the Lapu Lapu Day Festival): 2025: 36 health-care workers across multiple health authorities breached victims of the 2025 Vancouver Lapu-Lapu Day Festival Car Attack medical records. 71 unauthorized accesses across multiple health authorities. (Impacted authorities: Fraser Health, Vancouver Coastal Health, Provincial Health Services Authority, and Providence Health Care) https://youtu.be/CulzIubAsCo?si=CyP0tr3KlbrerH-Q
Dozens of B.C Health Care employees were flagged for intentional unauthorized access to patient personal information within Vancouver Coastal Health, Fraser Health, The Provincial Health Services Authority and Providence Health Care breached victims of the 2025 Vancouver Lapu-Lapu Day Festival Car Attack medical records.
News Story: Dozens of B.C. health‑care workers snooped on Lapu Lapu Festival victims’ medical records: OIPC report_
ByKraig Krause
Opens in new window
Published: February 18, 2026 at 8:52p.m. EST
Youtube CTV News Short Sharable Clip: https://youtube.com/shorts/q5XDzMe0XXE?si=BUdTAKZfjkAsDhcd
March 22, 2026: CHEK Media
Privacy breach at WorkSafeBC sends clients info to 'unknown recipients'
https://youtu.be/NKEhyVif8ZA?si=jh3FpD850Diuw6lR
These news stories are extremely relevant in ICBC' framework overreach into our medical system and needs to be further investigated, especially for those without independent primary care providers free of ICBC's framework to oversee their online health records in the CareConnect/HIM system and the versions that ICBC holds from the EHR system submitted through their unsecure portal system.
The fact that dozens of healthcare employees were recently caught intentionally snooping into the medical files of the 2025 Vancouver Car Attack victims proves that our electronic health systems are exposed. It shows that systems like CareConnect and HIM do not have the proper security locks to protect patients.
If hospital staff can easily bypass the rules to look at victims' private data, it proves how incredibly easy it is for a clinic or an insurance company to log into these portals.
This dangerous gap in security completely puts the integrity of our medical files at serious risk. It leaves injured British Columbians unprotected, especially if they do not have their own independent patient centered family doctor tracking and auditing their online health files to catch inaccuracies and missing information, and the legal oversight over the claim and care processes to discourgae bad-faith behaviour.