30th October 2026 – (Hong Kong) The Hospital Authority said it acknowledges the completion and publication of the Office of the Privacy Commissioner for Personal Data’s investigation into a suspected theft of patient information and the unlawful upload of data to a third‑party platform in the Kowloon East Cluster in April. The authority accepted the findings and recommendations and committed to take appropriate follow‑up actions, adding that it will continue to reinforce information‑system security to safeguard hospital operations, patient services and personal data.
In April, the authority’s routine surveillance detected the suspected incident, which arose from access‑control management by a contractor carrying out maintenance on a peripheral clinical system and led to the theft of some patient records. The authority reported the matter promptly to the Police and the Privacy Commissioner. Police subsequently arrested a contractor’s staff member on suspicion of access to a computer with dishonest intent. The authority said it has been fully co‑operating with both agencies and, as the criminal investigation is ongoing, it would not be appropriate to comment further.
Following the incident, the Kowloon East Cluster introduced a series of immediate measures and completed a comprehensive review to tighten information‑security controls and contractor supervision, aligning with the Privacy Commissioner’s recommendations. On‑site contractor system access must now be escorted by duly authorised hospital information‑technology staff, with records of identity, access purposes, operation time, and equipment movements. Data‑access logs for the relevant systems are audited on a regular basis, and contractors are required to submit periodic audit reports that flag any anomalous, unauthorised or suspicious activity. Oversight of access rights has been strengthened, with role‑ and function‑based permissions, restrictions to authorised personnel and circumstances, and data exports permitted only under specific approvals.
The cluster’s information‑technology department, together with the Information Technology and Health Informatics Division of the Hospital Authority Head Office, will conduct regular independent security risk assessments and audits in accordance with the authority’s Information Security Policy. The authority said affected patients and staff had previously been notified and offered an apology through multiple channels.
Reaffirming its stance on data protection, the authority said it monitors its information systems around the clock and will activate contingency measures promptly if anomalies are detected to protect the privacy of patients and staff. It will also maintain close liaison with the Privacy Commissioner and other law‑enforcement bodies, as well as professional cybersecurity organisations, to share security intelligence, continuously enhance system safeguards, strengthen internal training and data‑management policies, conduct regular testing and reviews, and adopt up‑to‑date security technologies and solutions to prevent unlawful acts.