Medical Forum
Patient records accessed in GP network cyber attack
Three clinics in WA were among a number of GPs clinics hit by a cyber attack in which patient records were stolen.
About the Author
Medical Forum
Partnered Health, which runs 57 primary care clinics across Australia, confirmed on its website that it had been the subject of a malicious cyber attack. The provider said patients’ medical records were accessed.
Some 21 GP clinics across the country were impacted during the attack on June 23, three of those were Western Australia.
They included Champion Drive Medical Centre, Joondalup City Medical Group and Rockingham City Family Practice.
Information that may have been accessed includes name, date of birth and contact details, as well as medical information and treatment details including consultation notes, referral letters, and pathology or diagnostic results recorded by a GP or other medical professional.
Medicare numbers, private health insurance details and Veteran Card (DVA) numbers may also have been accessed, Partnered Health confirmed.
It is yet to be determined if this information was accessed at the three WA clinics. Partnered Health said it was still investigating the extent to which personal information at these clinics had been accessed.
In an incident report on its website the provider said it had engaged specialist cyber experts after it became aware that a malicious actor had accessed data.
“We took immediate steps to contain the incident and assess whether personal information was accessed. This investigation remains ongoing," the statement said.
"Our investigations to date have confirmed that personal information (including health information) was taken from some of the clinics in our network.
“We are continuing to investigate the extent to which personal information has been impacted by this incident and are communicating with patients from impacted clinics.”
The Australian Cyber Security Centre, the Office of the Australian Information Commissioner and police have been notified.
An interim injunction exists in New South Wales, granted by the Supreme Court of NSW, where a majority of the clinics are located ordering that the accessed data is not used or published.
Partnered Health recently announced it was being acquired by private health insurer Bupa. The acquisition is currently being assessed by the ACCC and Foreign Investment Review Board for approval
The full list of practices impacted includes:
- Blackburn Road Medical Centre
- Broadway General Practice
- Bundall Medical Centre
- Cardiff Medical Centre & Skin Cancer Clinic
- Castle Hill Family Doctors
- Champion Drive Medical Centre
- Chancellor Park Family Medical Practice
- Dromana Family Doctors
- Dural Medical Centre
- Joondalup City Medical Group
- Kealba Family Practice
- Mornington Family Doctors
- Noosaville Seven Day Medical Centre
- North Canberra Family Practice
- Park Beach Family Practice
- Park Orchards Family Practice
- Rockingham City Family Practice
- Sans Souci Medical Practice
- Templestowe District Medical Centre
- Wentworth Avenue Family Practice
- Wyong Family Practice
Advice for patients
Patients who attend the GP clinics affected ae advised to:
- Be alert to any suspicious emails, text messages or phone calls
- Verify the identity of the sender before responding, including checking email addresses and phone numbers
- Do not click on links or open attachments in messages that look unusual or unexpected
- Ensure you use strong unique passwords for all accounts and enable multi-factor authentication where available
- Never provide personal, financial or account information in response to an unsolicited request, regardless of how legitimate it appears
- If you’re unsure whether a link or offer is genuine, go directly to the organisation’s website or contact them using details you already have
- Monitor your accounts for unusual activity and contact your bank if you notice anything suspicious
- Visit www.scamwatch.gov.au for further information on current scam trends.