In late 2025, a cyberattack compromised the online patient portal provided to public health organizations by Manage My Health, which held medical records of about 120,000 patients. Ransom hackers accessed and downloaded documents stored in the My Health Documents section of the portal and threatened to make these available on the dark web.

Risks of this kind are identified long before the breach. Third-party exposure, access control gaps, data handling issues — these are routinely flagged.

They are documented. Escalated. Acknowledged.

They do not consistently turn into funded work, enforced controls, or stopped deployments. They remain in reports while the system continues to move.

Clinical AI in Canada shows the same pattern: 176 initiatives, 9 system-wide deployments. Working solutions exist. They stay local.

The system detects. The system does not carry decisions through.