Government announces Medicare security review after darknet sale revealed
Former public service head Peter Shergold will lead the review into how 200,000 health professionals access Medicare
The Guardian, Gareth Hutchens and Paul Farrell, Mon 10 July 2017
The Turnbull government has announced a review the security of the online Medicare system and how doctors are able to access Medicare numbers after a darknet trader was discovered illegally selling patient details on request.
The former public service head Peter Shergold will lead the review, putting on notice thousands of doctors and other providers who have access to Medicare numbers via an online portal.
Guardian Australia revealed last week a darknet trader was offering the Medicare patient details of anyone for sale by “exploiting a vulnerability” in a government system, raising concerns that a health agency may be seriously compromised.
The data had been for sale since at least October 2016, and the seller appeared to have sold the Medicare details of at least 75 Australians.
The human services minister, Alan Tudge, and the health minister, Greg Hunt, announced the inquiry on Monday.
“Medicare cards and Medicare numbers have always been sought by criminals,” they said in a joint statement. “This review will identify options to improve the security of Medicare numbers while continuing to support the accessibility of medical care.
“The system, which has not been significantly altered since being brought in eight years ago, has to be both convenient and utterly secure. The review team will examine this balance to determine its adequacy in today’s context.”
Shergold, a former head of the Department of Prime Minister and Cabinet, will conduct the review with Michael Gannon , the president of the Australian Medical Association, and Bastian Seidel, the president of the Royal Australian College of General Practitioners.
The issue at hand is the operation of the Health Professionals Online Services (HPOS) web portal which is used by doctors, hospital staff and health clinics to look up Medicare numbers.
The government says the web portal is used about 45,000 times a day by health professionals. They can access it through a secure online system or over the phone to check the details of patients who do not have their Medicare card on them.
The panel’s terms of reference will examine crucial questions about access to medical services in Australia.
The review will assess what form of identifying information should be required to access Medicare treatments, the security controls in place to access Medicare card details and “any other identified area of potential weakness”.
It will make recommendations “for immediate practical improvements to the security of Medicare numbers while continuing to ensure people have access to the health care they need in a timely manner”.
More than 200,000 health professionals and administrators across Australia can readily obtain Medicare card details. The health department’s latest annual report shows that in 2016 there were 209,307 users able to access HPOS. All of these users would potentially be able to look up Medicare cards. The report says the system was accessed 3,929,685 times during this period.
The list of approved people includes administrative staff and other individuals as well as medical practitioners.
The number of users has risen 27% since 2015. Guardian Australia understands this is due to the department encouraging medical practices to use online services because of the cost of manually processing Medicare claims.
The government says the HPOS has changed little since it was introduced in 2009.
Last week Greens leader Richard Di Natale called for a Senate inquiry into the handling of Medicare data.
“We’re moving toward an electronic health record and people need to have the utmost confidence that their sensitive health information is going to be kept secure,” he said.
“That is why the Greens will be moving for a Senate inquiry when we return to ensure that this issue is dealt with and that we don’t have the same vulnerabilities across other areas that are supposed to be keeping sensitive health information secure.”
The review will begin immediately and will report by the end of September.
See the full article at: https://www.theguardian.com/australia-news/2017/jul/10/government-announces-medicare-security-review-after-darknet-sale-revealed
Comments