Hospital Authority responds to Office of Privacy Commissioner for Personal Data investigation report
The following is issued on behalf of the Hospital Authority:
The spokesperson for the Hospital Authority (HA) said today (October 30) that the HA notes the Office of the Privacy Commissioner for Personal Data (PCPD) has completed the investigation, and published the report today, regarding a suspected incident of patient data theft and the unlawful uploading of the data onto a third-party platform in the Kowloon East Cluster (KEC) in April this year. The HA accepts the investigation findings and recommendations, and will take appropriate action to seriously follow up on them. The HA will continue to strengthen its security of information system to ensure that hospital operations, patient services and personal data security are stringently protected.
The Hospital Authority. Photo source: reference image
In April this year, the HA's routine surveillance system detected a suspected incident of patient data theft in the KEC. The incident was an isolated event involving the management of data access control of a contractor during maintenance works in a peripheral clinical system, resulting in the theft of some patient data. The HA attaches great importance to the incident and had proactively reported it to Police and the PCPD in a timely manner. The Police subsequently arrested a staff member from the contractor on suspicion of access to a computer with dishonest intent. The HA has been fully co-operating with Police and the PCPD in the investigation. As the Police's criminal investigation is ongoing, it is not appropriate to further comment on the incident at this stage.
The HA takes the PCPD's recommendations on the protection of personal data seriously. Following the incident, the KEC immediately put in place a series of measures and conducted a comprehensive review, implementing a comprehensive strategy to strengthen the security of information system and oversight of contractors, including the procedures recommended by the PCPD, to prevent unauthorised access to the personal data of patients and staff through system maintenance work. The measures include:
- strictly requiring that whenever contractor personnel access the system on-site, they must be accompanied by duly authorised hospital information technology (IT) staff, with records kept of the contractor personnel's identity, purpose of access, time of operation, and equipment brought in and taken out;
- regularly auditing data access of the information systems concerned, and requiring contractors to submit audit reports to the HA periodically, reporting any anomalous, unauthorised or suspicious activities;
- strengthening oversight of contractors' access rights, configuring data access rights according to roles and functions, restricting use to authorised personnel and approved circumstances, and allowing data exports only under specifically approved circumstances; and
- regularly conducting independent security risk assessments and audits of the systems concerned by the cluster's IT department together with the Information Technology and Health Informatics Division of HA Head Office, in accordance with the HA Information Security Policy.
The KEC has previously informed and expressed an apology to the patients and staff affected through different channels.
The Office of the Privacy Commissioner for Personal Data. Photo source: reference image
The spokesperson emphasised that the HA has always attached great importance to the security of information systems and personal data privacy. The HA will continue to monitor the operation of its information systems around the clock and, should any anomaly be detected, appropriate contingency measures to safeguard the privacy of patients and staff will be taken promptly. The HA will also maintain close liaison with the PCPD and other law enforcement agencies, as well as professional cybersecurity organisations, to exchange security information and intelligence; continuously enhance system security; strengthen internal training, data management policies and guidelines; regularly conduct tests and reviews; and adopt up-to-date security technologies and solutions to effectively prevent any unlawful acts.
