Saskatchewan·CBC Investigates

Underfunding of aging Sask. health-care IT systems makes risk to patient lives 'inevitable': gov't memo

A blunt briefing note prepared for Saskatchewan's Minister of Health warns that eHealth, which runs the province's health-care IT system, has been underfunded for years and is at growing risk of failure, which could potentially affect patient safety. 

eHealth says $150M is needed over the next three years to update obsolete and failing equipment

eHealth Saskatchewan, which manages the provinces health-care IT system, says the provincial government has underfunded the organization for years, putting patient care at risk. (saskatchewan.ca)

A blunt briefing note prepared for Saskatchewan's Minister of Health warns that eHealth, which runs the province's health-care IT system, has been underfunded for years and is at growing risk of failure, which could potentially affect patient safety. 

eHealth is a Crown corporation responsible for operating, maintaining and renewing all computer systems that serve the health-care sector, from diagnostics to pharmaceuticals to patient records. 

The Oct. 26, 2020, document, written by eHealth and obtained by CBC through an access to information request, says that many of eHealth's hardware and software systems are out of date and "major outages that impact patient care delivery are increasing at a rate of 25 per cent per year."

It says that as time goes by, the risk to patient will grow unless the government steps up with millions in additional funding. 

"A major equipment failure which may disrupt service and risk lives appears inevitable with the current funding model," the briefing note warns. 

Aging systems at risk

The document  goes on to highlight the areas that are at risk. 

  • Admitting charting and hospital registration systems.

  • Laboratory diagnostics.

  • Medical imaging diagnostics.

  • Hospital pharmacy systems.

  • Contact tracing.

  • Vaccine inventory and public health services.

  • MySaskHealthRecord.

The note says that despite the growing risk, government investment in the infrastructure hasn't nearly kept up. 

"Over the past five years, funding has remained virtually static." 

eHealth says it provides IT equipment and support for about 400 health-care facilities across Saskatchewan. In a series of bullet points, the organization highlights problems it has identified:

  • "Some of the equipment is so old, automated systems can't be used to identify the PCs and laptops that are currently connected to that system."

  • "No archival records exist of what's being used by whom."

  • About 25 per cent of PC's in the system are more than five years old and running on old operating systems which, "makes it impossible to apply the latest and most up-to-date security patches."

  • "The Electronic Health Record (which collects and manages all patient records) runs on an Oracle database and has reached the end of its useful life." The note adds that the platform this record is based on has been around since 2010 and "is no longer supported."

In its briefing note, eHealth tells the minister that an immediate and ongoing cash injection is required. 

"To meet current expectations of customers and mitigate unacceptable risks to patient safety, eHealth will require an additional investment of $50 million per year above its historical base budget for the next three fiscal years," the note says. That base budget from the provincial government is about $110 million annually.  

That means eHealth is asking for a 45 per cent increase in its annual budget. 

According to a recent provincial auditor's report, the current value of eHealth's computer systems — including hardware and system development costs — sits at $6 million.

The briefing note suggests that some of these problems stem from the amalgamation of 12 health regions into one in 2017-18. eHealth was responsible for integrating all of the computer systems.

Saskatchewan's auditor Judy Ferguson says eHealth must complete the development of disaster recovery plans for its computer systems. (CBC News)

In the past, individual regions would fund outdated technology on an ad hoc basis, the note says. 

"Problems were solved through one-time capital allocations, taken from base budgets. Since amalgamation, this no longer takes place," the note says, adding that since that time new investment has been limited.

CBC asked Minister of Health Paul Merriman for an interview about the briefing note.

He provided a written statement.

"Any information regarding the health and lives of Saskatchewan residents being put at risk is concerning," said Merriman. "I will be asking Ministry of Health officials to look into this matter and to find ways to improve the systems supported by eHealth."

A follow-up note from the ministry pointed out that an "additional $21M was allocated this year to eHealth to enhance IT infrastructure."

Read the entire memo here:

Mobile users: View the document
(PDF KB)
(Text KB)
CBC is not responsible for 3rd party content

Ransomware attack highlights vulnerability

Vicki Mowat, the opposition critic for eHealth, said the NDP has been raising the issue of aging medical IT infrastructure for years. 

"It's quite concerning to see that during a pandemic these system failures are expected," she said. "We're talking about services that people rely on like contact tracing, vaccine inventory.

"It's incredibly concerning that lives are at risk because the government is sitting on their hands when it comes to health care."

Minister of Health Paul Merriman says he's asked his officials to investigate the concerns raised by eHealth. (CBC)

Mowat said a lack of new investment is particularly surprising given the vulnerabilities that were exposed in eHealth's system after a ransomware attack one year ago. 

That attack is currently under investigation by Saskatchewan's information and privacy commissioner. 

Vicki Mowat, the eHealth Critic with the Saskatchewan NDP, says she's surprised the government hasn't increased its investment in health IT given the recent ransomware attack. (Matt Garand/CBC)

According to the provincial auditor, the cyberattack was costly and harmful. 

"This attack led to a serious business disruption. It affected the ability of over 40,000 health sector employees to work effectively. eHealth also incurred significant costs to respond to the attack," she wrote in a Dec 8, 2020, report. 

In that report, she also noted that eHealth still doesn't have a disaster recovery plan for future cyberattacks. Her audit found that 38 eHealth systems didn't have full recovery plans. 

"I can't believe that after that this still hasn't been made a priority and there's such a lack of transparency about how bad the situation actually is," Mowat said.

About the Author

Geoff Leo

Senior Investigative Journalist

Geoff Leo has been a reporter for CBC News in Saskatchewan since 2001. His work as an investigative journalist and documentary producer has earned numerous national and regional awards.

Comments

To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.

now