Saskatchewan deletes vaccine QR codes while privacy glitch gets fixed

The Saskatchewan government says it's removing the QR codes from vaccination records temporarily following a privacy breach.

Records of up to 19 people inadvertently made accessible through other people's codes: eHealth

Saskatchewan released its new COVID-19 vaccination records with Quick Response (QR) codes on Sept. 20, 2021. (Matthew Howard/CBC)

The Saskatchewan government says it's temporarily removing the QR codes from vaccination records following a privacy breach.

The scannable codes were added as a quick way to display people's COVID-19 vaccination status. It's a key aspect of the province's vaccine passport system, which was already online but kicks into high gear next month.

However, eHealth says up to 19 of the codes were found to potentially display the wrong person's health information.

So far, it's been confirmed that only one person's data was inadvertently shared with the QR codes of three other people. The discovery was made Thursday.

The type of information displayed in the privacy breach would depend on the code reader used, eHealth vice-president of programs and technology Davin Church said.

"The majority would have just shown a name and vaccination status — so whether they were were vaccinated or not," Church said. "In others, they would have perhaps the name, date of birth and their vaccination information. "

EHealth is taking the whole system offline while it sorts out the issue.

"Any QR codes issued have been rendered invalid, so if they are attempted to be read, they will not be valid QR codes," Church said.

"We would ask that individuals dispose of those, delete them from devices."

Starting Saturday, people can print off their vaccination record again, but the QR code won't be attached.

People can also use their wallet-sized vaccination cards until the QR codes are fixed.

EHealth says it expects that to happen early next week.

Church said the vendor of the QR code system is Telus. Another company,  Akinox Solutions Inc., is in charge of the QR code "verifier app" and had no part in what happened, he said.

According to eHealth, the privacy breach has been reported to the information and privacy commissioner's office.


To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.

Become a CBC Member

Join the conversation  Create account

Already have an account?