Hong Kong’s medical sector lawmaker has said that he has proof that police can access the Hospital Authority’s system to check details of injured protesters who were admitted into the public hospital system, without using any special logins.
After a violent clash between protesters and the police last Wednesday over the controversial extradition bill, police admitted that they arrested protesters at public hospitals as they were being treated.
Pierre Chan, a lawmaker and public hospital doctor, said he received multiple tip-offs from staff at several hospitals about suspicions the Hospital Authority was leaking patient information – an accusation the authority had denied. The authority has said it would only issue general statistics for mass incidents, but not personal details.
Chan said that he received an internal email from the Hospital Authority stating that staff members should label the injured patients accepted on Wednesday using the description “Mass gathering outside Legco” and identify them as “police,” “reporter,” “civilian,” or “others.”
He said medical professionals at multiple public hospitals found that the Hospital Authority’s system had a loophole whereby anyone could obtain patient information without logging in. He showed the reporters the steps to do so at a press conference on Monday.
A page in the system contained a label that reads “For Police.” In a row marked “Mass gathering outside Legco,” the Clinical Management System displayed names, identity card numbers, gender, age, phone numbers, time, dates and admission locations for 76 patients.
“I have adequate evidence to prove that the two statements from the Hospital Authority [denying personal information leaks] were lies,” Chan said.
He said he had never seen such a list before, but he was very concerned since the Hospital Authority said the system had been in use for years.
“We are concerned about the safety and privacy of injured residents,” he said. “Some injured people have told me they no longer trust the emergency room. This is a very serious incident.”
Chan said he asked the Hospital Authority to reveal the incident to the public but did not receive a response, thus he had to publicise it.
“The Hospital Authority should investigate thoroughly and apologise,” he said.
In a statement later on Monday, the Hospital Authority said its emergency room information system is a closed one, and no non-Hospital Authority personnel have the right to log in.
It said all data requests of data must be made to the Hospital Authority and must be for the reasons of rescue, assisting the injured or family members: “For the June 12 protests, the Hospital Authority did not give any information of patients to the police,” it said.
The authority said it condemned “untrue remarks” that damaged the relationship between doctors and patients, adding it would look into whether someone had leaked printed patient data using the system.
During a press conference on late Monday night, the Hospital Authority confirmed computers at emergency rooms are always logged in, but stated again that they are only for the use of authorised medical staff.
Chan has urged the privacy commissioner to investigate.
The Hong Kong Free Press #PressForFreedom 2019 Funding Drive seeks to raise HK$1.2m to support our non-profit newsroom and dedicated team of multi-media, multi-lingual reporters. HKFP is backed by readers, run by journalists and is immune to political and commercial pressure. This year’s critical fundraiser will provide us with the essential funds to continue our work into next year.