Dark web incident with Medicare data leaking
Following the revelation that Medicare card details are being sold on the dark web, the idea has been raised that the online trader involved in the fraudulent activity may have obtained the Medicare numbers from a healthcare professional who has access to the a Medicare database. Healthcare providers can search online via the Department of Human Services website by providing the patient’s surname, first name and date of birth. A successful search returns the Medicare number and Individual Reference Number (IRN), precisely the details which were being sold online to anyone willing to pay for it. Consequently, the government has now appointed former public service chief Peter Shergold to lead an investigation into the Health Professional Online Service (HPOS).
Health Professional Online Services (HPOS)
vThe Health Professional Online Service was introduced in 2009 as a single entry point for a large range of services for health professionals. An enhanced lookup function was added a year later to allow health providers to look up Medicare card details of patients by entering the patient’s name and date of birth in situations where the Medicare card was unavailable. The lookup function was designed to allow treatment of patients in emergency situations and is currently used by providers around 45,000 times each day. Similarly, details can also be obtained via a telephone service.
Investigation into the Health Professional Online Service (HPOS)
Mr Shergold will work with the Australian medical Association and the Royal Australian College of General Practitioners with support from the Department of Human Services, Department of Health, and Attorney General’s Department. The investigation will look at, amongst other issues, security risks and controls surrounding the provision of Medicare numbers to healthcare professionals.
There is a concern that accessing Medicare numbers may become more difficult for healthcare professionals as a result of proposed changes. The review is expected to provide immediate practical improvements of the security of Medicare numbers but not impact on patients obtaining health care if they don’t have their Medicare card with them.
An interim report is expected by mid-August of this year with finalised view expected at the end of September.