Alert: Reported Phishing Scam Affecting Pharmacy Teams and Patients in British Columbia. Feb. 28, 2020

Alert: Reported Phishing Scam Affecting Pharmacy Teams and Patients in British Columbia. 

The College has received multiple reports from community pharmacies in BC of a phishing scam targeting patients for their personal information. 

A number of patients have received phone calls from a caller posing as a pharmacy staff member and asking for personal and/or credit card information. 

The excuses provided by the scammer for needing patients’ personal and/or credit card information include: 

• Verifying card information for a delivery payment 
• Updating patient profiles 
• Rectifying a billing error 

What to Do If You Receive a Suspicious Phone Call – Patients 

Scammers may obtain your telephone number fraudulently or from public lists, such as a phone book. As such, even those with unlisted numbers can receive phishing phone calls. 

Scammers will usually claim to represent legitimate companies or community pharmacies in an attempt to trick you into providing personal and/or credit card information. 

The College urges patients and members of the public not to give your credit card or personal information over the phone, unless you made the call, or can verify that the caller is a registered health professional and/or that you have a professional care relationship with them. 

If you are unable to verify the identity of the caller, the easiest thing to do is hang up and contact your pharmacist in person or over the phone to confirm that the request for information is legitimate. 

If you receive an unsolicited call asking for credit card and/or personal information, and are unable to verify the legitimacy of the request, hang up and report the incident to The Canadian Anti-Fraud Centre and/or the RCMP or local police department. 

What To Do If You Think You’ve Been Scammed 

If you have given your personal, health or credit card information to a caller that you now suspect to have been fraudulent, The Canadian Radio-television and Telecommunications Commission (CRTC) recommends the following: 

• Alert your financial institution. If you have provided your account details to a scammer, contact your bank or financial institution immediately and let them know.
• Get further assistance. Contact the Canadian Identity Theft Support Centre at http://idtheftsupportcentre.org/ or by dialing 1-866-436-5461.
• File a complaint. You can report unwanted telemarketing calls at www.lnnte-dncl.gc.ca or by calling 1-866-580-DNCL (3625).
• Contact law enforcement. If you think the call might be part of a fraud scheme, contact law enforcement authorities or the Canadian Anti-Fraud Centre.

Protecting Patient Confidentiality and Health Information in BC – Expectations for Registrants

There are many layers to ensuring personal health information is protected – from following BC’s privacy legislation and establishing appropriate operational policies , to upholding ethical obligations. Modern pharmacy practice also uses a number pharmacy database systems, such as PharmaNet in BC, for tasks that include data collection and patient record management which also require high standards to ensure health information security. 

Privacy Protection Legislation in BC

In British Columbia, there are two distinct pieces of legislation governing the protection of privacy: 

• Public bodies (such as health authorities and the College) fall under the Freedom of Information and Protection of Privacy Act (FOIPPA).
• Businesses (such as community pharmacies) fall under the Personal Information Protection Act (PIPA).

Code of Ethics

Standard 4 of the College’s Code of Ethics sets out requirements for ensuring patient information is kept confidential. 

1. Registrants respect their patients’ right to privacy and confidentiality. 
2. Registrants do their utmost to protect patient confidentiality when they share patient information with colleagues or other health care professionals 
3. Registrants do not disclose confidential information without the consent of the patient, unless provided for by law or by the need to protect the welfare of the individual or the public interest.
4. Registrants maintain confidentiality in creating, storing, accessing, transferring and disposing of records they control 

Pharmacy System Security

PharmaNet is a valuable tool for protecting public safety. It allows pharmacy professionals to review a patient’s complete medication history and check a prescription for drug allergies and harmful drug interactions before dispensing medication. 

In order to uphold legislative requirements and ethical obligations regarding patient privacy and confidentiality, it is vital that pharmacies practice proper system security when using PharmaNet or other pharmacy database systems. 

The Pharmacy Operations and Drug Scheduling Act (PODSA), Bylaws, s. 35(2), sets out the following rules regarding Data Collection, Transmission of and Access to PharmaNet Data:

All registrants should ensure their network accounts are secure and remember they are ultimately responsible for all activity associated with their licence number.

The PharmaNet Professional and Software Compliance Standards, Volume 5 provides standards for PharmaNet System Security with regards to: 

• User IDs 
• Passwords, and 
• Other Authentication

Additional Resources

• Pharmacy Matters: Pharmacy System Security 
• Pharmacy Matters: PharmaNet Access.
• ReadLinks: Personal Health Information and Privacy Rights
• Canadian Anti-Fraud Centre
• Personal Information Protection Act
• Canadian Radio-television and Telecommunications Commission – How to Protect Yourself from Scammers