Class-Action Lawsuit After Data Breach at Medical Marijuana Clinic

A national medical marijuana clinic has announced a data breach its seven locations, including one in Windsor.

Natural Health Services notified customers last week that the personal medical data of close to 34,000 patients was accessed between December 4, 2018 and January 7 of this year.

Law firm Diamond and Diamond recently announced it's looking into a class-action suit against the clinic and its parent company Sunniva Inc.

Lawyer Steven Wilder says the breach is a massive violation of personal privacy, saying the company has admitted admitted diagnostic results, health-care numbers and personal contact information were stolen, but there could be more.

"They have warned some of their customers and clients, if they receive calls from third-parties soliciting sales or trying to obtain information, to contact the Privacy Commissioner and potentially the police as well," he says. "On that basis, with that warning, it is quite concerning to think what information was ultimately accessed improperly?"

No financial, credit card or social insurance number information was stolen, but Wilder says leaking personal medical information can be just as damaging.

"To hear that information has been breached and potentially shared with people that should not have access to it is a very big concern and not a common one," he says. "We often hear about financial data breaches, but I would say that a breach of medical records and diagnosis is much worse."

Wilder says the firm has heard from several people in the region already, and they're looking for more to step forward.

[CLIP] ... a class action claim if warranted."

"If they think they've been impacted by this breach, certainly if they've received an email or a letter from NHS notifying them of the breach, they should definitely reach out and contact us," he says. "We will get their information, investigate on their behalf and move forward with a class action claim if warranted."

Natural Health Services says it has been working with privacy protection and law enforcement authorities to investigate and respond to the breach.

Wilder says anyone who may have been involved in the breach should contact Diamond and Diamond as soon as possible.