Partnered Health’s national network of GP and skin cancer clinics was hit by a major cyber attack on June 23 impacting medical records and personal information.
Partnered Health operates over 50 general practice and skin cancer clinics across Australia, and has identified at least 21 clinics where patient information was stolen, including in Sydney, Melbourne and Canberra.
The company said in a statement, “Our investigations to date have confirmed that personal information (including health information) was taken from some of the clinics in our network. We are continuing to investigate the extent to which personal information has been impacted by this incident and are communicating with patients from impacted clinics.”
Partnered Health’s Primary Care Group operates a national network of general practices and skin cancer clinics, supported by TeleWell, a 24/7 telehealth platform that ensures continuous access to trusted GPs. The group also includes allied health leaders such as Fuel Your Life, Australia’s largest dietitian provider, and Northcare Physio, South Australia’s largest physiotherapy network.
University of Melbourne Professor in the School of Computing and Information Systems Toby Murray said, “This incident is a timely reminder about the dangers of centralising sensitive information into large systems.
“This incident breached a large network of GP health clinics. Whenever businesses store sensitive information in a common computer system, such as the kind of cloud-based storage systems that might have underpinned the operation of Partnered Health’s various clinics, there is a risk that if the system is breached, many individuals will be affected.
“Operators of large businesses with sites that span many locations should set up their IT so that each site can access only the information that it needs, with careful processes established for when information needs to be shared between sites to ensure that only what needs to be shared is shared and with only the people who need to access it,” he said.
Partnered Health has reported the incident to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and law enforcement and obtained an interim injunction from the Supreme Court of New South Wales ordering that the accessed data is not used or published.
There is also a dedicated website page with further information, including steps patients can take to help protect their personal information.
Add Comment