Opposition says government has ignored warnings about Meditech system for years

PC opposition leader David Brazil says the Newfoundland and Labrador government has been ignoring internal and external warnings about the age of its system for storing electronic health records for "years."

On Tuesday, the last day of the House of Assembly fall session, Brazil said there have been documented warnings about the aging system by multiple individuals — some of whom he believes may soon go public.

"There's been information passed on internally and externally, too, saying that there are challenges within the system there, that it could be hacked very easily," Brazil said.

According to the Meditech website, the Newfoundland and Labrador government first chose the system as its preferred health-care information system nearly 40 years ago. The system has been upgraded as technology has changed, but Brazil said the current version is outdated. 

Premier Andrew Furey, an orthopedic surgeon, told reporters that the Meditech system is a problem, and he is aware of its age. He said the government may consider an overhaul.

"This is a great ... time for us to reflect on the system and see if it's the one that we want to go forward with," he said.

CBC News has asked Meditech for comment.

Justice Minister John Hogan said the investigation hasn't found any evidence that the Meditech system is connected with the cause of the attack.

"The investigation will keep looking into what happened and as soon as we have information that we're able to reveal to the public about that, we will," he said.

Brazil said individuals familiar with the health-care system have told him that the investigators likely know exactly how the attack occurred and where it originated, but officials aren't saying.

"There's more information that's not being shared than the information that is being shared right now," he said.

So far, officials have not shared details on the nature of the cyberattack, how the attack was able to occur or who is behind it. 

The RCMP and the Office of the Information and Privacy Commissioner have both opened investigations.

Sources have told CBC News that the attack is a ransomware attack, a cybersecurity incident where a hacker takes control of a system, and only returns control after a ransom has been paid. Government officials have refused to say if there was a ransom demand.