More than 200,000 health professionals and administrators across Australia can readily obtain Medicare card details, raising further concerns about the security of Medicare data that has been sold on the darket.
On Tuesday the Guardian revealed that a darknet trader was illegally selling the Medicare patient details of any Australian on request by “exploiting a vulnerability” in a government system.
The human services minister, Alan Tudge, has referred the matter to the Australian federal police amid widespread concern that Australians’ Medicare card details had been compromised.
Tudge has repeatedly said the data that was sold was likely to be the fruit of “traditional criminal activity” rather than some form of hacking. His comments suggest the department believes Medicare details were accessed using legitimate login credentials to a health system but in an unauthorised manner.
The department relies on a system called Health Professional Online Services to allow health practitioners to lodge claims online. It can also be used to access patients’ Medicare card details.
But the Guardian can reveal that the number of users approved to access Medicare data is far higher than previously thought. The department’s latest annual report shows that in 2016 there were 209,307 users able to access HPOS. All of these users would potentially be able to look up Medicare cards. The report says the system was accessed 3,929,685 times during this period.
The number of users has spiked since 2015, with a 27% rise. Guardian Australia understands this jump is due to a major push by the department to drive medical practices to use online services because of the cost of manually processing Medicare claims.
While the list of approved people can include medical practitioners, it also includes adminstrative staff and other individuals.
The federal government is facing heavy pressure over the breach. The Greens leader, Richard Di Natale, has called for a Senate inquiry into the handling of Australians’ Medicare data.
“We’re moving toward an electronic health record and people need to have the utmost confidence that their sensitive health information is going to be kept secure,” he said.
“That is why the Greens will be moving for a Senate inquiry when we return to ensure that this issue is dealt with and that we don’t have the same vulnerabilities across other areas that are supposed to be keeping sensitive health information secure.”
The privacy commissioner, Timothy Pilgrim, has also issued a statement. He told the Guardian: “Information such as our Medicare card numbers is valuable and should be protected from misuse. I am concerned about any allegation that personal information of Australians is being offered for sale on the darkweb, particularly if it is suggested to be government-held information.
“I note that the minister has advised that the Australian federal police are investigating these allegations and I have requested that they and the Department of Human Services keep my office informed of the progress of this investigation. I will await the outcome of their inquiries at this time.”
It is possible that Australians who have had their Medicare card details compromised may have a right of action under the Privacy Act to seek compensation and other orders against the Department of Human Services. The personal details of at least 75 Australians have been sold on the darkweb but it is unclear whether the government is aware of all of their identities.
The Australian Taxation Office temporarily suspended Medicare cards from use as proof of identification documents but quickly withdrew their suspension on Wednesday.
The move suggested the ATO held concerns about the integrity of Medicare cards as a valid form of identification for Australians.
