Hong Kong Hospital Authority accepts privacy watchdog's findings on data breach
Hong Kong's Hospital Authority says it accepts a privacy watchdog report into an April data breach affecting patients in Kowloon East, and will strengthen IT security and contractor oversight. The breach involved a contractor employee who was arrested.
The Hospital Authority (HA) on 30 October said it accepts the findings and recommendations of a report by the Office of the Privacy Commissioner for Personal Data (PCPD) into a suspected patient data leak in April. The HA said it will take appropriate action and continue to enhance information system security to protect hospital operations, patient services and personal data.
The incident, discovered by the HA's routine monitoring system, involved a breach of patient data in the Kowloon East Hospital Cluster. The HA described it as an isolated case related to data access management during maintenance work by an outsourced contractor. The HA said it reported the matter to police and the PCPD immediately. Police arrested a contractor employee on suspicion of unauthorised access to a computer. The HA said it has fully cooperated with police and the PCPD investigations, but declined further comment as a criminal investigation is ongoing.
In response to the PCPD's recommendations, the Kowloon East Hospital Cluster said it has already implemented a series of measures and conducted a comprehensive review. These include requiring all contractor personnel to be accompanied by authorised HA information technology staff when accessing systems on site, with records kept of their identity, purpose, operation time and equipment brought in or out.
Other measures include regular audits of data access to the affected information system, with contractors required to submit audit reports to the HA detailing any abnormal, unauthorised or suspicious activity. The HA said it will also strengthen contractor access controls, configure data access rights by function, restrict use to authorised personnel and approved circumstances, and allow data export only in specific approved cases.
The cluster's IT department, together with the HA's head office IT and health information division, will conduct independent security risk assessments and reviews of relevant systems in line with the HA's information security policy. The Kowloon East Hospital Cluster has already notified and apologised to all affected patients and staff through various channels.
The HA reiterated that it places high priority on information system security and personal data privacy, and will continue to monitor all information systems around the clock. It said it will maintain close contact with the PCPD, law enforcement agencies and professional network security organisations to exchange security information, enhance system security, strengthen internal training and data management policies, and adopt up-to-date security technologies and solutions.