Hospital Authority responds to Office of Privacy Commissioner for Personal Data investigation report
The following is issued on behalf of the Hospital Authority:
The spokesperson for the Hospital Authority (HA) said today (October 30) that the HA notes the Office of the Privacy Commissioner for Personal Data (PCPD) has completed the investigation, and published the report today, regarding a suspected incident of patient data theft and the unlawful uploading of the data onto a third-party platform in the Kowloon East Cluster (KEC) in April this year. The HA accepts the investigation findings and recommendations, and will take appropriate action to seriously follow up on them. The HA will continue to strengthen its security of information system to ensure that hospital operations, patient services and personal data security are stringently protected.
The Hospital Authority. Photo source: reference image
In April this year, the HA's routine surveillance system detected a suspected incident of patient data theft in the KEC. The incident was an isolated event involving the management of data access control of a contractor during maintenance works in a peripheral clinical system, resulting in the theft of some patient data. The HA attaches great importance to the incident and had proactively reported it to Police and the PCPD in a timely manner. The Police subsequently arrested a staff member from the contractor on suspicion of access to a computer with dishonest intent. The HA has been fully co-operating with Police and the PCPD in the investigation. As the Police's criminal investigation is ongoing, it is not appropriate to further comment on the incident at this stage.
The HA takes the PCPD's recommendations on the protection of personal data seriously. Following the incident, the KEC immediately put in place a series of measures and conducted a comprehensive review, implementing a comprehensive strategy to strengthen the security of information system and oversight of contractors, including the procedures recommended by the PCPD, to prevent unauthorised access to the personal data of patients and staff through system maintenance work. The measures include:
- strictly requiring that whenever contractor personnel access the system on-site, they must be accompanied by duly authorised hospital information technology (IT) staff, with records kept of the contractor personnel's identity, purpose of access, time of operation, and equipment brought in and taken out;
- regularly auditing data access of the information systems concerned, and requiring contractors to submit audit reports to the HA periodically, reporting any anomalous, unauthorised or suspicious activities;
- strengthening oversight of contractors' access rights, configuring data access rights according to roles and functions, restricting use to authorised personnel and approved circumstances, and allowing data exports only under specifically approved circumstances; and
- regularly conducting independent security risk assessments and audits of the systems concerned by the cluster's IT department together with the Information Technology and Health Informatics Division of HA Head Office, in accordance with the HA Information Security Policy.
The KEC has previously informed and expressed an apology to the patients and staff affected through different channels.
The Office of the Privacy Commissioner for Personal Data. Photo source: reference image
The spokesperson emphasised that the HA has always attached great importance to the security of information systems and personal data privacy. The HA will continue to monitor the operation of its information systems around the clock and, should any anomaly be detected, appropriate contingency measures to safeguard the privacy of patients and staff will be taken promptly. The HA will also maintain close liaison with the PCPD and other law enforcement agencies, as well as professional cybersecurity organisations, to exchange security information and intelligence; continuously enhance system security; strengthen internal training, data management policies and guidelines; regularly conduct tests and reviews; and adopt up-to-date security technologies and solutions to effectively prevent any unlawful acts.
Development Bureau and Housing Bureau announce comprehensive reforms to building maintenance regulatory regime and support services
Based on the findings of the report of the Independent Committee (IC), the Development Bureau (DEVB) and the Housing Bureau today (October 30) jointly announced the details of comprehensive reform measures. The DEVB will spearhead three measures, including the establishment of the Building Maintenance Support and Services Council (BMSSC) by the end of the year, the submission of proposed amendments to the Buildings Ordinance (Cap. 123) (BO) to the Legislative Council before the end of this year, and the commencement of the organisational restructuring of the Buildings Department (BD) in the first quarter of next year. Meanwhile, the Housing Bureau will establish the Public Housing Building Control Section (PBC) within November 2026 to replace the Independent Checking Unit, and launch a new regulatory regime to strengthen the regulation of large-scale maintenance and renovation works in courts/estates.
Establishment of the BMSSC
As pointed out by the IC, building maintenance and renovation concern the private property of citizens. The responsibility for building management rests with the owners, while the Government's role is to ensure that building maintenance and renovation works are carried out in a healthy and clean market environment. As the new support services differ significantly in both the breadth and depth from the previous "Smart Tender" services provided by the Urban Renewal Authority (URA), the Government will establish the BMSSC to take the lead in the work. The BMSSC will provide more proactive support to owners by offering services at different stages on behalf of owners, demonstrating the Government's commitment while allowing the URA to focus on urban renewal.
The BMSSC will be a non-statutory company wholly owned by the Financial Secretary Incorporated. The Government aims to complete the registration of the company and the appointment of its Board of Directors by the end of this year. Recruitment of the Chief Executive Officer and other staff are underway, so that the company can take over the provision of the new support services from the URA as soon as possible. In accordance with the original plan, three Pre-qualified Lists will be progressively available by the end of this year. Inspection consultants will be assigned starting from the coming January, with project tendering for owners commencing within the first quarter of 2027.
The four major areas of responsibilities of the BMSSC are–
(a) formulating and updating building maintenance and renovation measures in accordance with Government strategies to support owners in properly maintaining properties and effectively addressing the problem of building ageing;
(b) providing new support services to owners and conducting regular reviews and optimisation to ensure that the services meet owners' needs; are independent, reliable, professional; and that the service fees are reasonable, while maintaining the long-term financial sustainability of the BMSSC;
(c) leveraging technology including artificial intelligence to develop and manage database of building maintenance and renovation works cost and other information with a view to assisting owners in making informed decisions and detecting irregularities or misconduct during tendering; and
(d) implementing Government building maintenance subsidy schemes to provide financial assistance to owners in need.
Upon its establishment, the BMSSC will initially focus on the work under (a) to (c) above, including giving priority to handling about 1 800 maintenance and renovation projects under the original "Smart Tender" for which contractors have not yet been engaged, and will progressively take over the work under (d) currently undertaken by the URA in due course. The specific functions of the BMSSC are set out in Annex 1.
The Board of the BMSSC will comprise official and non-official directors. The appointment of directors (including the non-official director serving as Chairman) and the Chief Executive Officer will be approved by the Chief Executive. A rigorous declaration of interests system will be put in place to prevent conflicts of interests of its directors and employees. The BMSSC will also be designated as a public body under the Prevention of Bribery Ordinance (Cap. 201) (the Ordinance) in future, subjecting its directors and employees to more stringent regulation under the Ordinance. In this year's Budget, $100 million has been earmarked as start-up capital for the BMSSC, covering initial staff expenditure and other operating expenses. The BMSSC is expected to achieve self-financing in the long run.
The BMSSC will provide two service options –
(a) free service – Three Pre-qualified Lists, sample tender documents and sample works contracts, as well as past works cost data, will be made available free of charge. Owners may make reference to such information and conduct their own tendering through the electronic platform of the BMSSC to engage inspection consultants, supervision consultants and contractors;
(b) standard fee-charging service – end-to-end services will be provided, including –
(i) pre-arranging the recruitment of inspection consultants so that they can be assigned to owners for appointment to carry out building inspections as early as possible. As there is no need to conduct separate tendering for building inspection for individual projects, this important starting point of building inspection can be properly commenced as early as possible;
(ii) conducting tendering and tender evaluation on behalf of owners for the engagement of supervision consultants and contractors respectively (the former responsible for drafting works plans and tender documents, and the latter for conducting works), and then recommending up to three tenders based on the ranking of tender evaluation scores. Owners receiving government maintenance subsidies must make appointments from the recommended tenders. Owners not receiving government maintenance subsidies may decide on their own whether to appoint from the recommended tenders (if they choose not to accept any recommended tenders, the BMSSC will not provide further services during the subsequent works stage of the project);
(iii) during the works stage, supervision consultant will take primary responsibility for assisting owners in supervising the works; while the BMSSC will assist owners in monitoring whether the supervision consultant has provided the services in accordance with the contract, including requiring the supervision consultant to submit supervision progress reports regularly. In addition to uploading the said reports to the electronic platform for owners' monitoring, the BMSSC will also review the reports to assess the consultant's performance; and
(iv) if substantial amendments to the scope of works or increase in works costs are required during the works stage, the supervision consultant must first submit a report so that the BMSSC can provide independent advice to the owners.
Owners receiving government maintenance subsidies must adopt the standard fee-charging service under (b) above. The standard fee service will be calculated on a cost-recovery basis, and preliminary estimate of the cost would be several thousand dollars per household. The BMSSC will make good use of the additional $200 million earmarked in this year's Budget to provide fee concessions to owners in need. The BMSSC will announce the fee and subsidy details in due course.
Regarding the suggestion of establishing a single body to take full responsibility for building maintenance and regulatory work, different advocates have put forward various views on the roles and functions of such a body. The DEVB considers that the establishment of the BMSSC by the Government is a more prudent and pragmatic approach, taking into account the following considerations: first, enforcement, investigation and prosecution are Government's duties and functions involving the exercise of public powers, and should therefore continue to be undertaken by Government officers to ensure independence and consistency of enforcement. Second, if the central body employs consultants and contractors to carry out all building maintenance and renovation works on behalf of owners, or even decides on behalf of owners whether to accept inspection reports, pass the scope of works, and select consultants and contractors, etc, such kind of comprehensive "agency" model not only deviates from the principle that owners should be responsible for maintaining their own properties, but also weaken owners' right to choose. A single body using its own consultants and works teams to monopolise all building maintenance and renovation works will also affect market competition. Concentrating a large number of maintenance responsibilities in a single body may also result in unbearable responsibilities and legal risks. All these are complex issues to handle.
Proposed Amendments to the BO
The DEVB proposes to amend the BO. The latest amendment proposals include (details in Annex 2):
(a) Establishing large-scale repair as a new category of works, with strengthened statutory regulation and heavier penalties for non-compliance. This includes the requirement to submit plans and a site supervision plan to the BD to obtain a permit before works can commence. Applicable penalties for non-compliance will be aligned with those for new building works (i.e. substantially higher than those currently applicable under the minor works control regime). The qualifications of professionals and contractors who may supervise and carry out such works will also be tightened, so as to enhance the overall effectiveness of supervision and the quality of works.
(b) Clearly defining powers and responsibilities to elevate professional independence. The two functions under the Mandatory Building Inspection Scheme (MBIS)— namely, building inspection and the subsequent works planning and supervision functions — will be separated. It will be stipulated that these two functions for the same maintenance and renovation project must be undertaken by different professionals, so as to sever the chain of interests.
(c) Strengthening building and fire safety standards, empowering the BD to prescribe requirements for safety measures and standards for building materials through practice notes or circular letter, and creating a new offence so that prosecution can be instituted directly for contravention of the requirements specified by the BD, thereby enhancing the effectiveness of prosecution. An "Expert Panel on Large-scale Repair" to be led by the DEVB will assist in formulating the macro standards, principles and guidelines for large-scale repair.
(d) Significantly raising the maximum fines for non-compliance. In general, the fines will be three times the current levels (and even higher for certain offences), so as to enhance deterrence against non-compliance.
(e) Tightening the registration renewal and disciplinary systems for professionals and contractors, including substantially raising disciplinary fines, and strictly enforcing the deregistration mechanism, such as immediate deregistration without disciplinary hearing for professionals or contractors who have committed offences under the Prevention of Bribery Ordinance or the Competition Ordinance, as well as expediting and enhancing the handling of disciplinary hearing cases.
The proposed BO amendments must be accompanied by vigorous enforcement in order to achieve deterrent effect. Regardless of whether the works are related to new building or maintenance and renovation, the BD will proactively step up the review of the industry's performance, strengthen enforcement and prosecution, and severely punish non-compliance. This includes comprehensively reviewing building inspection and supervision reports under the MBIS, and stepping up on-site audits and surprise inspections. Details are set out in Annex 2 (II)(i) and (ii).
Revamping Organisational Structure of the BD
Following the shift to a more proactive regulatory model, the BD needs to undertake a substantive amount of enforcement work. To meet the challenges, the BD will revamp its organisational structure to comprehensively enhance its enforcement capabilities. The department will carefully review its manpower deployment and additional manpower requirements.
The reorganisation mainly covers the following aspects. First, two divisions, each led by a Deputy Director, will be set up at the top management level to oversee new buildings and existing buildings respectively, ensuring that there is sufficient high-level leadership and reasonable division of labour and resource deployment within the department to supervise the regulatory work of new and existing buildings. Second, the existing sectional arrangements for existing buildings will be reformed. The current six sections across the territory will be reorganised into ten teams and be put under a District Chief system. Each district team will be led by a directorate officer of the BD, Leading departmental professional and technical staff to follow closely the situation of existing buildings within the district. The district teams will comprehensively take charge of enforcement work under the BO for existing buildings in their respective district, including end-to-end monitoring of the MBIS and enforcement against unauthorised building works. As the convenor, each District Chief will lead an inter-departmental task group, comprising officers from the Housing Bureau, Fire Services Department and Labour Department, etc, to promote communication and collaboration among departments in respect of site inspections and handling of complaints for projects under the MBIS in the district, ensuring that project safety risks and complaints are properly handled. Third, a "Dedicated Audit and Monitoring Section" will be established to conduct internal audits of departmental work and the delegated enforcement work of the newly established PBC under the Housing Bureau. This Section reports directly to the Director of Buildings. Fourth, a directorate officer will be seconded to the PBC to strengthen communication between the BD and the PBC and assist the PBC in effectively discharging its delegated duties. Details of the reorganisation are set out in Annex 3.
Radical reform of the ICU and establishment of the PBC
The HB will establish the PBC within November to replace the existing ICU. The PBC will strengthen and focus regulation of existing buildings and maintenance works of all public rental housing (PRH) estates and subsidised sale housing courts and related facilities sold or divested by the Hong Kong Housing Authority (HA). The PBC will also regulate new public housing development projects (including PRH and subsidised sale housing) by the HA, as well as relevant works for existing PRH estates that have not been divested.
Maintenance and renovation project-based regime
In regulating existing buildings, the PBC will implement a new regulatory regime. Instead of the current practice where multiple regulatory teams with different functional scopes (such as the MBIS team, minor works team, site monitoring team and existing building team) carry out regulatory work independently based on their respective functions, the approach will be shifted to a project-based model of building maintenance and renovation works. This will provide macro-level co-ordination and comprehensive handling of large-scale maintenance and renovation projects in housing courts/estates, particularly those involving large-scale maintenance works with high risks, thereby improving the overall project co-ordination, communication, and risk control.
Establishment of project-specific teams
Where individual public housing courts/estates carry out major building maintenance and renovation works regulated under the BO, the Head of the PBC will set up a project-specific team for the court/estate concerned to co-ordinate and handle related works matters in an integrated manner. The project team will specifically assign a dedicated member of staff as liaison officer to proactively contact the Owners' Corporation and provide necessary assistance on maintenance and renovation matters.
Strengthen direct communication with the BD
As abovementioned, to ensure accurate and effective exercise of the powers under the BO delegated by the Director of Buildings in future, the BD will shortly second a directorate officer to the PBC to further strengthen accurate, direct and prompt communication between the two departments. The subject directorate officer will provide direct guidance and participate in the daily regulation of existing buildings, offer professional advice of the BD and the BO to the PBC staff, assist in establishing operation guidelines and monitoring mechanism, as well as assisting in the conduct of continuous training for team staff on their awareness and ability in law enforcement.
Following the DEVB's amendments to the BO, the PBC will proactively and fully implement the amended BO and strictly enforce the statutory requirements. The PBC will also fully cooperate with the regular audits by the BD's Dedicated Audit and Monitoring Section, so as to ensure effectiveness and consistency in enforcement approach and standards.
Ongoing improvement measures
The newly established PBC will continue to implement the improvement measures that the ICU has put in place for regulating major maintenance and renovation works of housing courts/estates, covering targeted regulation of maintenance and renovation works of housing courts/estates, introduction of routine surprise inspections, enhancement in monitoring the performance of Registered Inspectors and Registered Contractors, making good use of technology to combat fraud, establishment of cross-departmental co-ordination and information-sharing mechanism, strict enforcement of the BD's requirements on fire safety precautionary measures, etc.
Source: AI-found images
