1. CYBER RISKS IN THE HEALTHCARE INDUSTRY HIROC 's Annual Risk Management Conference, April 2015 Jim Patterson, Partner, Co-Head of Fraud Law, Toronto, Bennett Jones LLP, pattersonj@bennettjones.compattersonj@bennettjones.com Michele Beals, Interim Joint VP Finance & CFO, William Osler Health System, Headwaters Health Care Centre, michele.beals@williamoslerhs.camichele.beals@williamoslerhs.ca

2. Cybercrime – What is it? Criminal offences involving a computer as the object of the crime (i.e. hacking, phishing, and spamming); and Criminal offences involving a computer as the tool used to commit a material component of the offence (i.e. identity theft, intellectual property infringements, money laundering, child sexual exploitation, and cyber bullying). See section 342 of the Criminal Code Cyber threats are both internal and external 2

3. Cybercrime Affecting the Healthcare Industry Healthcare records are particularly valuable to cybercriminals because the data has broad utility. It is exposed to various threats : Hacking Phishing Spoofing Zombie Computers Botnet Operations Malware 3

4. Two main types of threats 1)Attack requires no information from the victim 2)Victim's active involvement required Both types have their own unique risk management issues Highest risks are when victims are misled to believe that messages are from internal or trusted sources 4

5. Effective Management of a Cyber Attack Case Study 5

6. Case Study (Phishing targeting public sector) Phishing email was sent to the executive office announcing electronic banking changes and requesting the completion of a system update. Email forwarded to accounting department requesting the matter be addressed. Finance staff acted on this direction and completed the update as requested. Routine review of banking files at the start of a work week highlighted the 3 questionable payroll files processed over the weekend. Working with the bank it was confirmed the account had been compromised approximately 1 month after the phishing email had been acted on. 6

7. Case Study – lessons learned All it takes is a click of an email Early involvement of HIROC provided expertise and guidance Cyber crimes are highly sophisticated Internal emails create a sense of urgency and or comfort – education around email generated phishing needs to be to directed to all staff on a frequent basis Understand your banking agreements Banks will never place a systems login request using an email with a direct link. 2 stage banking authorization, by 2 individuals is best practice – external confirmation with a token is optimal. 7

8. Reporting Cybercrime HIROC Report early for best results Canadian Anti-Fraud Centre Partnership among the RCMP, the Ontario Provincial Police and the Competition Bureau Canada's central repository for data and fraud intelligence Local Police Banks Ensure that counsel review banking agreements to identify liabilities for any cybercrime that affect the organization’s bank accounts 8

9. CYBER RISKS IN THE HEALTHCARE INDUSTRY HIROC 's Annual Risk Management Conference, April 2015 Jim Patterson, Partner, Co-Head of Fraud Law, Toronto, Bennett Jones LLP, pattersonj@bennettjones.com pattersonj@bennettjones.com Michele Beals, Interim Joint VP Finance & CFO, William Osler Health System, Headwaters Health Care Centre, michele.beals@williamoslerhs.ca michele.beals@williamoslerhs.ca