The province of Saskatchewan has cancelled all of the QR codes that have been issued as proof of vaccination and residents who have downloaded them are asked to delete them.

An issue arose when one person was found to have their information embedded in the QR codes of three other people. 

“Any QR codes are invalid and we ask individuals to dispose of them or delete them from devices or dispose of them if they are printed on paper,” said Davin Church, Vice President, Programs & Technology, eHealth Saskatchewan in a digital news conference on Sept. 24.

The issue was identified late on Sept. 23 and the SHA responded by shutting down the eHealth site and notifying Telus, the vendor. 

Access to the website was removed for the night and restored today but records will remain unavailable until Saturday. Then, the printed record will not include a QR code.

Church said that new QR codes will be issued early next week at which point people can issue themselves a new code on their eHealth account. 

The Office of the Information and Privacy Commissioner has been notified.

“We are continuing to work through the resolution of that technical issue with our vendor,” he said.

Other forms of proof of vaccination are available, such as the cards issued when a person receives their vaccine.

While only one person has been identified as having an issue, up to 19 people may have already been affected.

The companies that created the QR code and the app for reading them are two separate companies and not connected, said Church.

He said that the incident required a very specific set of circumstances to align in order to happen and that is it not something that would be easy to re-create.

“However, we do know what the issue was and the vendor has worked to resolve that issue,” Church said.

They would not disclose technical details of how exactly the issue came up in the first place but did say that the type of information that came up depended on the app used to read it.

“The majority would have just shown a name and vaccination status so if they were vaccinated or not,” Church said. “In others, they would have seen name, date of birth and their vaccination information.”

The queue to access the eHealth site remains in place, which regulates the amount of traffic allowed on the site, something the province planned for the onset of the code availability last week.

“There is until Oct 1 when these are required for people, the former wallet cards are proof as well as previous forms that might have been printed out,” he explained.

The only thing that has changed is the cancellation of the code.

People are asked to contact eHealth Saskatchewan’s Privacy Officer if they have noticed another individual’s name appear when their QR code is scanned. Email at privacyandaccess@eHealthsask.ca.

. susan.mcneil@paherald.sk.ca

.