Extension of period of stay for holders of APEC Business Travel Card
The Immigration Department (ImmD) announced today (October 30) that, with effect from November 1, 2026, the visa-free period of stay in Hong Kong for holders of the Asia-Pacific Economic Co-operation (APEC) Business Travel Card (ABTC) who have obtained pre-clearance from the Hong Kong Special Administrative Region (HKSAR) will be extended to 90 days.
The Immigration Department. Photo source: reference image
An ImmD spokesman said, "The APEC Business Mobility Group (BMG) has announced that five participating economies of the ABTC Scheme, namely the People's Republic of China; Hong Kong, China; Indonesia; the Philippines; and Singapore, will extend the maximum period of stay for visiting ABTC holders from 60 days to 90 days, with a view to further enhancing the effectiveness of the ABTC. The specific implementation timeline will be determined by the relevant economies. Our country will implement the new arrangement from November 1, 2026."
The spokesman continued, "In line with our country's implementation date, with effect from November 1, 2026, ABTC holders who have obtained pre-clearance from the HKSAR will have their maximum visa-free period of stay in the HKSAR extended from 60 days to 90 days. Other immigration arrangements regarding the entry of ABTC holders into the HKSAR will remain unchanged."
At present, there are 19 economies participating in the ABTC Scheme, namely Australia; Brunei Darussalam; Chile; the People's Republic of China; Hong Kong, China; Indonesia; Japan; the Republic of Korea; Malaysia; Mexico; New Zealand; Papua New Guinea; Peru; the Philippines; Russia; Singapore; Chinese Taipei; Thailand; and Vietnam. In addition, the United States and Canada are transitional members of the ABTC Scheme and do not process pre-clearance applications referred by other participating economies. ABTC holders are still required to meet relevant entry requirements, including applying for necessary visas (if applicable).
The Immigration Department. Photo source: reference image
Hong Kong residents holding a Hong Kong permanent identity card and a valid national passport are eligible to apply for an ABTC from the ImmD. Applicants must be bona fide business persons who need to travel frequently to APEC economies for short-term business visits, have no criminal record and have never been refused entry to any of the participating economies.
An ABTC is normally valid for five years. ABTC holders who have obtained pre-clearance from relevant participating economies can enjoy a visa-free period of stay for not less than 60 days. ABTC holders may also use the special service lanes at selected control points of the participating economies for speedy immigration clearance.
Hospital Authority responds to Office of Privacy Commissioner for Personal Data investigation report
The following is issued on behalf of the Hospital Authority:
The spokesperson for the Hospital Authority (HA) said today (October 30) that the HA notes the Office of the Privacy Commissioner for Personal Data (PCPD) has completed the investigation, and published the report today, regarding a suspected incident of patient data theft and the unlawful uploading of the data onto a third-party platform in the Kowloon East Cluster (KEC) in April this year. The HA accepts the investigation findings and recommendations, and will take appropriate action to seriously follow up on them. The HA will continue to strengthen its security of information system to ensure that hospital operations, patient services and personal data security are stringently protected.
The Hospital Authority. Photo source: reference image
In April this year, the HA's routine surveillance system detected a suspected incident of patient data theft in the KEC. The incident was an isolated event involving the management of data access control of a contractor during maintenance works in a peripheral clinical system, resulting in the theft of some patient data. The HA attaches great importance to the incident and had proactively reported it to Police and the PCPD in a timely manner. The Police subsequently arrested a staff member from the contractor on suspicion of access to a computer with dishonest intent. The HA has been fully co-operating with Police and the PCPD in the investigation. As the Police's criminal investigation is ongoing, it is not appropriate to further comment on the incident at this stage.
The HA takes the PCPD's recommendations on the protection of personal data seriously. Following the incident, the KEC immediately put in place a series of measures and conducted a comprehensive review, implementing a comprehensive strategy to strengthen the security of information system and oversight of contractors, including the procedures recommended by the PCPD, to prevent unauthorised access to the personal data of patients and staff through system maintenance work. The measures include:
- strictly requiring that whenever contractor personnel access the system on-site, they must be accompanied by duly authorised hospital information technology (IT) staff, with records kept of the contractor personnel's identity, purpose of access, time of operation, and equipment brought in and taken out;
- regularly auditing data access of the information systems concerned, and requiring contractors to submit audit reports to the HA periodically, reporting any anomalous, unauthorised or suspicious activities;
- strengthening oversight of contractors' access rights, configuring data access rights according to roles and functions, restricting use to authorised personnel and approved circumstances, and allowing data exports only under specifically approved circumstances; and
- regularly conducting independent security risk assessments and audits of the systems concerned by the cluster's IT department together with the Information Technology and Health Informatics Division of HA Head Office, in accordance with the HA Information Security Policy.
The KEC has previously informed and expressed an apology to the patients and staff affected through different channels.
The Office of the Privacy Commissioner for Personal Data. Photo source: reference image
The spokesperson emphasised that the HA has always attached great importance to the security of information systems and personal data privacy. The HA will continue to monitor the operation of its information systems around the clock and, should any anomaly be detected, appropriate contingency measures to safeguard the privacy of patients and staff will be taken promptly. The HA will also maintain close liaison with the PCPD and other law enforcement agencies, as well as professional cybersecurity organisations, to exchange security information and intelligence; continuously enhance system security; strengthen internal training, data management policies and guidelines; regularly conduct tests and reviews; and adopt up-to-date security technologies and solutions to effectively prevent any unlawful acts.
