Privacy issues force temporary removal of QR codes from vaccination records

Four days after being launched, QR codes are temporarily being removed from Saskatchewan residents’ COVID-19 vaccination records due to privacy issues.

The Government of Saskatchewan said Friday afternoon the move was made due “to an issue downloading patient QR codes.”

The codes started appearing on people’s vaccination records on MySaskHealthRecord accounts on Monday.

According to Davin Church, the vice-president of programs and technology with eHealth Saskatchewan, the organization was informed late Thursday that the wrong person’s information was showing up in one person’s QR code.

“In an abundance of caution we did remove access to the website last evening, as we continued to work through understanding the issue at hand,” Church said Friday.

People can access the website again as of Friday evening, but vaccination records without a QR code won’t be available again until Saturday morning.

Church explained one person’s information showed up in three different people’s QR codes, and depending on which app was used to view the information, it could have included their name, birth date, and vaccination information. As many as 19 people’s codes could be affected.

The person whose privacy was breached has been contacted, as has the Office of the Information and Privacy Officer of Saskatchewan.

“The vendor has reassured us that they have identified that issue, are working to resolve it and are doing substantial retesting over the next couple days,” said Church.

Church declined to explain what the issue was, saying that security best practices preclude disclosing details.

“This incident required a very specific and rare set of circumstances to align in order to occur, so it wasn’t something that was largely easy to recreate and so we do know what the issue was and the vendor has worked to resolve that issue,” said Church.

Anyone who printed, downloaded or took a picture of their QR code from Sunday through Friday is urged to destroy or delete any records with their code since it’ll be invalid.

People also are asked to contact eHealth Saskatchewan’s privacy officer if they have noticed another person’s name when their QR code is scanned. Email at privacyandaccess@eHealthsask.ca.

In the absence of QR codes, wallet cards or an earlier version of a person’s MySaskHealthRecord COVID-19 vaccine certificate, as well as a COVID-19 vaccine printout from the Saskatchewan Health Authority, can be used as proof of vaccination.