MediSecure breach: scripts, GPs leaked

Patient prescriptions which were sent over the government’s former electronic prescription service MediSecure have been compromised in a major breach.

Patient prescriptions that were sent over the government’s former electronic prescription service MediSecure have been compromised in a major breach.

Patient prescriptions and GP and healthcare provider private information has been leaked in a major medical data breach which is being responded to by Australia’s highest levels of cyber defence.

Cyber Security Coordinator LtGen Michelle McGuinness on Monday confirmed that the prescriptions of patients who had used MediSecure’s electronic prescription service up until November last year had been compromised in the MediSecure breach, which was widely reported late last week.

GPs and other medical practitioners involved in prescribing and the handling of electronic prescriptions have also been impacted.

MediSecure, which outed itself as a victim of the breach before Cyber Security Minister Clare O’Neil and the Department of Home Affairs had, has updated its website to reflect the preliminary findings of the investigation into the breach.

“We can confirm the cyber security incident impacts personal information and limited health information relating to prescriptions. Additionally, this cyber security incident also impacts the personal information of healthcare providers,” it said in a statement on its website.

Federal authorities have said it is still unclear how many Australians have been affected by the large-scale data breach that targeted electronic prescriptions provider MediSecure. Picture: Google

“MediSecure understands this will be concerning to our customers, and we are working very hard to communicate with impacted individuals as soon as possible. We appreciate your continued patience, and we will provide further updates to the community when available.”

On Thursday last week, LtGen McGuinness convened the Australian Federal Police and the Australian Signals Directorate Australian Cyber Security Centre to work on a response to the situation.

The breach arrives about six months after MediSecure was dumped by the government for new provider Fred IT Group’s eRx Script Exchange, which won a tendering process in May last year.

The eRx Script Exchange service took over from MediSecure in November, and is not impacted by the breach, the Department of Home Affairs has confirmed.

“The national prescription delivery service, eRx, is not affected by this cyber incident. Consumers can continue to access medicines safely, and healthcare providers can still prescribe and dispense as usual,” it said.

LtGen McGuinness said an investigation into the breach was ongoing and more would be revealed soon. “On the incident itself, it is important to remember that the response is still in preliminary stages and information is still being obtained,” she said.