Source: Radio New Zealand
RNZ/Calvin Samuel
MediMap, the hacked health portal, is heading to court to try to block people accessing and using the data that has been breached.
It was breached on Sunday, and the company has now taken the platform offline while it investigates.
It’s used for prescribing and giving medication in places like residential aged care, hospices, disability services and community health.
In a new statement on Wednesday, it said it was urgently seeking an injunction to protect the information of impacted people.
“This injunction would prohibit anyone from accessing, using, copying, sharing, or publishing any MediMap data that may have been unlawfully obtained, and would seek to limit any further spread of that information online,” it said.
MediMap said it also sincerely apologised for any distress the hack may have caused.
“We understand this situation is concerning for residents, patients, their families, and healthcare providers.”
It said its own investigation into what it called alleged unauthorised access and data modification was ongoing, and that the company was working to find any personal information that may have been accessed by an authorised third party.
“Once this process is complete and we have verified the facts, we will contact affected customers directly regarding any necessary next steps,” its statement said.
According to information sent by MediMap to care providers in the early hours of Wednesday morning, and seen by RNZ, fields that were changed included patient name, date of birth, location within the facility, assigned prescriber or pharmacy, allergy or intolerance information or discharge or deceased status.
Providers with the portal offline have told RNZ medication was now being organised the old-fashioned way – on paper.
A Nurses Organisation member at George Manning Lifecare and Village in Christchurch told RNZ they needed double the number of registered nurses on each shift just to give out medication.
Aged Care Association chief executive Tracey Martin said every care home had a “disaster” plan to fall back on in case of something like a system outage.
“Basically, they had to switch back to paper-based.”
She understood it was not having an effect on residents, who were all still receiving medication, but some facilities might have needed to bring in extra staff who were qualified to double check the medication, before it was given to residents.
“It certainly takes longer, it’s certainly more painful than the efficiencies that you get through a digital system,” Martin said.
Most of the questions being asked were: “Is my mum still getting her medication?” and “How are you making sure that she gets what she needs?”
“With regard to somebody being marked as deceased or not? Well, our facilities have got the person there, so they know they’re not deceased. So while from a system perspective that is really interesting and needs to be sorted, from a real-life perspective, that individual’s still there, still being cared for.”
FAQs released by MediMap
Among the information sent from MediMap care providers were lists of frequently asked questions those companies might be getting, and how to respond to them, along with a draft email providers could use as a template to inform patients, residents and families.
MediMap said it was working with external cyber security and forensic specialists, Health NZ, and relevant authorities to identify which facilities and resident records had been affected, and passwords were being reset across all users “as a precautionary measure”.
“Importantly, we have been advised that there is currently no evidence that medication charts or medication administration records have been altered,” it said.
“Has resident data been exposed? – At this stage, we cannot confirm whether any resident data has been accessed beyond viewing, extracted, or exposed externally. The investigation is ongoing.”
“When will our facility be brought back online? – Facilities will be restored in phases. Facilities where current resident information has not been modified will be restored first following internal validation. Facilities where resident information may have been impacted will be contacted directly by MediMap to confirm current resident details prior to restoration.”
“Why are discharged or deceased residents being reviewed? – Some resident status information may have been incorrectly modified. Historical records will be reviewed following restoration of current residents.”
What is the health agency saying?
Health New Zealand, while supporting the company’s investigation, said MediMap, as a privately owned company, was solely responsible for its security and it needed to do everything it could.
Its digital services acting chief information technology officer Darren Douglass said New Zealanders expected companies involved in healthcare to secure systems and platforms so private information was safeguarded.
Privacy commissioner says New Zealanders expect better
The privacy commissioner told Midday Report changing people’s information was as much of a breach of privacy as stealing it.
With the system offline, he said, patients are now “relying on the professionalism of the health sector” to ensure they got the right medication.
Michael Webster said New Zealanders rightly expected companies with sensitive information to have higher standards of privacy and protection than any other area.
“The expectation out there from New Zealanders is increasingly, this information has to be protected, and has to be seen to be protected as well as any information – and better.”
He said it was not yet known how many people had been affected.
The commission was working with MediMap to understand the scale of the hack, Webster said, and he expected to receive updates as that work progressed.
MediMap has declined an interview with RNZ, but has again been approached for comment.
Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.
– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand
