Canberra clinics and patient data caught up in nationwide healthcare network hack
Kingston’s Wentworth Avenue Family Practice is one of two Canberra clinics caught up in a cyber attack. Photo: Google Maps.
Two Canberra clinics have been caught up in a cyberattack that could have exposed the personal information of their current and former patients.
Partnered Health alerted the community on 15 July that a “malicious actor” had accessed data at its clinics on 23 June.
“We took immediate steps to contain the incident and assess whether personal information was accessed. This investigation remains ongoing,” a statement read.
“Our investigations to date have confirmed that personal information (including health information) was taken from some of the clinics in our network.
“We are continuing to investigate the extent to which personal information has been impacted by this incident and are communicating with patients from impacted clinics.”
Affected practices owned by Partnered Health include North Canberra Family Practice in Belconnen and Wentworth Avenue Family Practice in Kingston.
Personal information that may have been accessed includes a patient’s name, date of birth, address and contact details; their Medicare number, private health insurance or Veteran Card (DVA) number or concession card number; and medical information and treatment details, including consultation notes, referral letters, and pathology or diagnostic results recorded by a GP or other medical professionals at the clinics.
One North Canberra patient told Region they were shocked to think a hacker would target a Canberra doctor’s clinic.
“I never imagined something like that would happen,” they said.
“I do appreciate the fact the clinic has alerted us all to the data breach. I hope other clinics here in Canberra use this as a warning, to consider the strength of their cyber security systems and to review them to ensure something like this doesn’t happen anywhere else.”
Some former patients have expressed surprise that the clinics still held their details.
According to the Royal Australian College of GPs, the Federal Privacy Act requires health information to be destroyed or permanently de-identified once it’s no longer needed for “any authorised use or disclosure”.
But the law is different in the ACT.
“The ACT, NSW and Victoria require medical records to be retained until a young person turns 25, and for adults, for seven years from the date of the provision of the last health service. This overrides the Privacy Act,” information on the RACGP’s website stated.
“Under some state and territory legislation, the destruction of any medical record is prevented when the record is likely to be involved in legal proceedings. It is recommended to seek advice on the current limitation periods that apply to your practice.
“GPs must appropriately destroy or permanently de-identify health information following the expiry of these periods.”
Partnered Health has reported the incident to the Australian Cyber Security Centre and law enforcement.
It has also set up a dedicated support webpage and team for concerned current and former patients caught up in the hack.
“To help protect our patients and people, we have obtained an interim injunction from the Supreme Court of New South Wales ordering that the accessed data is not used or published,” a statement outlined.
“We have also notified the Office of the Australian Information Commissioner about the incident.”
Services Australia has been alerted to the incident, and additional monitoring has been placed on all active Medicare cards that may have been impacted.
Canberrans have been advised to be alert to any suspicious emails, text messages or phone calls, and not to click on links or open attachments in messages that look unusual or suspicious.
If you’re unsure whether a link or offer is genuine, visit the organisation’s website or contact them using the details you already have.
Contact your bank if you notice any suspicious activity in your accounts.
Updates can be found through Partnered Health. Those with further questions can call 1300 093 807 between Monday and Friday, 9 am to 5 pm or email support@partneredhealth.com.au.
